Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1529402
MD5:008d4c1cdb9b763e867f32ce0e5219be
SHA1:d8265514c93b7a41fbf9e9ef89df3964b2dab522
SHA256:2d6e0324011f23f51b7f221e2bcb7562292cb71d2f65228f004059f857bff4f1
Tags:exeuser-Bitsight
Infos:

Detection

Credential Flusher
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Uses taskkill to terminate processes

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 7272 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 008D4C1CDB9B763E867F32CE0E5219BE)
    • taskkill.exe (PID: 7288 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7420 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7476 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7540 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7608 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • firefox.exe (PID: 7672 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • taskkill.exe (PID: 1868 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 1476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 5252 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 2284 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • chrome.exe (PID: 7696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5440 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • firefox.exe (PID: 7704 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 7724 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 7932 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2116 -prefMapHandle 2088 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6173e676-c43b-4cb8-a736-2d8aff0db5d2} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c864f6f710 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 7576 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4484 -parentBuildID 20230927232528 -prefsHandle 4212 -prefMapHandle 4428 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8da78f2-518e-408c-bcad-9b17924570ea} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c864f7b310 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8592 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4964 -prefMapHandle 3712 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c73dd90-851d-4d9d-9772-142af10aaa4f} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c87e79d710 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000003.2053297015.00000000015C3000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialFlusherYara detected Credential FlusherJoe Security
    00000000.00000002.3303862059.00000000015A8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialFlusherYara detected Credential FlusherJoe Security
      Process Memory Space: file.exe PID: 7272JoeSecurity_CredentialFlusherYara detected Credential FlusherJoe Security

        Sigma Signatures

        ⊘No Sigma rule has matched

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Multi AV Scanner detection for submitted file
        Source: file.exeReversingLabs: Detection: 15%
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
        Machine Learning detection for sample
        Source: file.exeJoe Sandbox ML: detected
        Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49750 version: TLS 1.0
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49718 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49722 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49738 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49742 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49822 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49834 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49833 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61507 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:61510 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 52.222.236.23:443 -> 192.168.2.5:61509 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:61517 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61518 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61519 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61520 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:61550 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:61630 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61687 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61688 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61693 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61694 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61696 version: TLS 1.2
        Source: Binary string: UxTheme.pdb source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358419025.000001C87CE1A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: rsaenh.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wininet.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wshbth.pdbGCTL source: firefox.exe, 0000000E.00000003.2355303915.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: kbdus.pdb source: firefox.exe, 0000000E.00000003.2344423978.000001C874DF3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344798677.000001C874DF4000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2C4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: bcrypt.pdb source: firefox.exe, 0000000E.00000003.2359661956.000001C87C982000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359329721.000001C87CA8A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: rpcrt4.pdb source: firefox.exe, 0000000E.00000003.2358711945.000001C87CD53000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: pnrpnsp.pdb source: firefox.exe, 0000000E.00000003.2355945891.000001C87E74C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2353194945.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321439169.000001C87E74C000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wshbth.pdb source: firefox.exe, 0000000E.00000003.2355303915.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ktmw32.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: NapiNSP.pdb source: firefox.exe, 0000000E.00000003.2349251170.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: msvcrt.pdb source: firefox.exe, 0000000E.00000003.2329875068.000001C87CAB4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: xWindows.StateRepositoryPS.pdb source: firefox.exe, 0000000E.00000003.2324563637.000001C87CE67000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: xOneCoreUAPCommonProxyStub.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2C4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: webauthn.pdbGCTL source: firefox.exe, 0000000E.00000003.2353902486.000001C87FD01000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: xul.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: crypt32.pdbjTx source: firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: shcore.pdb source: firefox.exe, 0000000E.00000003.2329037683.000001C87CEC2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: mozglue.pdb source: firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: winnsi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: cryptsp.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: sspicli.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: CLBCatQ.pdb source: firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ntmarta.pdb source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE39000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000E.00000003.2349251170.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: dnsapi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: nlaapi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: firefox.pdb source: firefox.exe, 0000000E.00000003.2330491155.000001C878526000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: winhttp.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: netprofm.pdb source: firefox.exe, 0000000E.00000003.2348901211.000001C87FD01000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: msimg32.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wsock32.pdbP4 source: firefox.exe, 0000000E.00000003.2357676227.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ntasn1.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: win32u.pdb source: firefox.exe, 0000000E.00000003.2325664477.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358605369.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: netprofm.pdbUGP source: firefox.exe, 0000000E.00000003.2348901211.000001C87FD01000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: firefox.pdb source: firefox.exe, 0000000E.00000003.2330491155.000001C878526000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: dbghelp.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: imm32.pdb source: firefox.exe, 0000000E.00000003.2358419025.000001C87CE1A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: webauthn.pdb source: firefox.exe, 0000000E.00000003.2353902486.000001C87FD01000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: gdi32.pdb source: firefox.exe, 0000000E.00000003.2325664477.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358605369.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358419025.000001C87CE1A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: profapi.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ws2_32.pdb source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF41000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: avrt.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: WLDP.pdb source: firefox.exe, 0000000E.00000003.2324563637.000001C87CEB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEC2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: mswsock.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: sechost.pdb source: firefox.exe, 0000000E.00000003.2358711945.000001C87CD53000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: shell32.pdbe source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE39000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: nsi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: propsys.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: twinapi.pdb@b source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.14.dr
        Source: Binary string: winmm.pdb source: firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: winrnr.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: msctf.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: version.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ole32.pdb source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF41000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: dbgcore.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: kbdus.pdbGCTL source: firefox.exe, 0000000E.00000003.2344423978.000001C874DF3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344798677.000001C874DF4000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: user32.pdb source: firefox.exe, 0000000E.00000003.2325664477.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358605369.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: twinapi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: msasn1.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.14.dr
        Source: Binary string: psapi.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: DWrite.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ntdll.pdb source: firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: combase.pdb source: firefox.exe, 0000000E.00000003.2358419025.000001C87CE1A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: pnrpnsp.pdbUGP source: firefox.exe, 0000000E.00000003.2353194945.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: shell32.pdbP4 source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE39000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ncrypt.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: nss3.pdb source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF41000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wsock32.pdb source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF41000.00000004.00000800.00020000.00000000.sdmp
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_0012DBBE
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000FC2A2 FindFirstFileExW,0_2_000FC2A2
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001368EE FindFirstFileW,FindClose,0_2_001368EE
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_0013698F
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0012D076
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0012D3A9
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00139642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00139642
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0013979D
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00139B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00139B2B
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00135C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00135C97
        Source: firefox.exeMemory has grown: Private usage: 41MB later: 195MB
        Source: global trafficTCP traffic: 192.168.2.5:61502 -> 1.1.1.1:53
        Source: Joe Sandbox ViewIP Address: 34.117.188.166 34.117.188.166
        Source: Joe Sandbox ViewIP Address: 52.222.236.23 52.222.236.23
        Source: Joe Sandbox ViewIP Address: 34.149.100.209 34.149.100.209
        Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
        Source: Joe Sandbox ViewJA3 fingerprint: 1138de370e523e824bbca92d049a3777
        Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
        Source: Joe Sandbox ViewJA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
        Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49750 version: TLS 1.0
        Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
        Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
        Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
        Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
        Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
        Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
        Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.45
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_0013CE44
        Source: global trafficHTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
        Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UHSu4tku32A9Dsw&MD=YD5C61TL HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
        Source: global trafficHTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=802863228&timestamp=1728425060295 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=J0EkMtTXPoTycP7KbDpsfAd6WfDdLEWBVcpDGfXNyetgottqucD2bqnEqRCA3UaOn4o-jdn6P3dkc_iu56AGHOD1s8K02EQOY0pDbHqEvfE6NLGI8x2DSwxrgb_UY4J7RGxQdJ4g4FAzw6WpvxtbBTwkCXeZhoSFoSqq6QpgSwRNnwC1CCQ
        Source: global trafficHTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UHSu4tku32A9Dsw&MD=YD5C61TL HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
        Source: global trafficHTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
        Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
        Source: firefox.exe, 0000000E.00000003.2359661956.000001C87C95E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8*://www.facebook.com/* equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205171631.000001C87E78D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205171631.000001C87E78D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205068681.000001C87E806000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2359661956.000001C87C95E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
        Source: chromecache_211.25.drString found in binary or memory: _.oq(p)+"/familylink/privacy/notice/embedded?langCountry="+_.oq(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.oq(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.oq(_.xq(c))+"&hl="+_.oq(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.oq(m)+"/chromebook/termsofservice.html?languageCode="+_.oq(d)+"&regionCode="+_.oq(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205171631.000001C87E78D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205171631.000001C87E78D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205068681.000001C87E806000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
        Source: firefox.exe, 0000000E.00000003.2359661956.000001C87C95E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
        Source: global trafficDNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
        Source: global trafficDNS traffic detected: DNS query: detectportal.firefox.com
        Source: global trafficDNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
        Source: global trafficDNS traffic detected: DNS query: youtube.com
        Source: global trafficDNS traffic detected: DNS query: example.org
        Source: global trafficDNS traffic detected: DNS query: ipv4only.arpa
        Source: global trafficDNS traffic detected: DNS query: contile.services.mozilla.com
        Source: global trafficDNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
        Source: global trafficDNS traffic detected: DNS query: spocs.getpocket.com
        Source: global trafficDNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
        Source: global trafficDNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
        Source: global trafficDNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
        Source: global trafficDNS traffic detected: DNS query: www.youtube.com
        Source: global trafficDNS traffic detected: DNS query: www.google.com
        Source: global trafficDNS traffic detected: DNS query: shavar.services.mozilla.com
        Source: global trafficDNS traffic detected: DNS query: accounts.youtube.com
        Source: global trafficDNS traffic detected: DNS query: support.mozilla.org
        Source: global trafficDNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
        Source: global trafficDNS traffic detected: DNS query: play.google.com
        Source: global trafficDNS traffic detected: DNS query: push.services.mozilla.com
        Source: global trafficDNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
        Source: global trafficDNS traffic detected: DNS query: firefox.settings.services.mozilla.com
        Source: global trafficDNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
        Source: global trafficDNS traffic detected: DNS query: services.addons.mozilla.org
        Source: global trafficDNS traffic detected: DNS query: normandy.cdn.mozilla.net
        Source: global trafficDNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
        Source: unknownHTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 518sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: firefox.exe, 0000000E.00000003.2182765006.000001C87E796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2399345299.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321135125.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205171631.000001C87E78D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359661956.000001C87C982000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2405953520.000001C875D53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2172021862.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://127.0.0.1:
        Source: firefox.exe, 0000000E.00000003.2399726836.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
        Source: firefox.exe, 0000000E.00000003.2399726836.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
        Source: firefox.exe, 0000000E.00000003.2399726836.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
        Source: firefox.exe, 0000000E.00000003.2399726836.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344423978.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344907446.000001C874DCE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2346421876.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
        Source: firefox.exe, 0000000E.00000003.2338002321.000001C874DC8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2337486850.000001C874DC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
        Source: firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
        Source: firefox.exe, 0000000E.00000003.2338002321.000001C874DC8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2337486850.000001C874DC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
        Source: firefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
        Source: gmpopenh264.dll.tmp.14.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
        Source: firefox.exe, 0000000E.00000003.2338002321.000001C874DC8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2337486850.000001C874DC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344423978.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344907446.000001C874DCE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2346421876.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
        Source: firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
        Source: firefox.exe, 0000000E.00000003.2338002321.000001C874DC8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2337486850.000001C874DC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344423978.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344907446.000001C874DCE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2346421876.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
        Source: gmpopenh264.dll.tmp.14.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CDAC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
        Source: firefox.exe, 0000000E.00000003.2182688273.000001C87E7BC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/
        Source: firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2406888585.000001C8758F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
        Source: firefox.exe, 0000000E.00000003.2320643894.000001C87E83D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CDAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
        Source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
        Source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
        Source: firefox.exe, 0000000E.00000003.2396054615.000001C876EED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878526000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2297329741.000001C876ED3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/
        Source: firefox.exe, 0000000E.00000003.2242755035.000001C874E9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379857345.000001C8749EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197551104.000001C87D1DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210277720.000001C874AE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2375602286.000001C874E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329536974.000001C87CE5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305530700.000001C8751A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2221377640.000001C874A48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2145571847.000001C87D0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2386744316.000001C8722FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279301102.000001C874ADD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227059810.000001C8749D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307224519.000001C8722F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2114379885.000001C8751A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328204760.000001C87796A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2371008508.000001C8751A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2407406877.000001C8756CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210277720.000001C874AD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2404755287.000001C8762CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2281997658.000001C874AD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2408759298.000001C876C9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
        Source: firefox.exe, 0000000E.00000003.2338002321.000001C874DC8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2337486850.000001C874DC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
        Source: firefox.exe, 0000000E.00000003.2338002321.000001C874DC8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344423978.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344907446.000001C874DCE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2346421876.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2337486850.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.drString found in binary or memory: http://ocsp.digicert.com0C
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.drString found in binary or memory: http://ocsp.digicert.com0N
        Source: firefox.exe, 0000000E.00000003.2336072278.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
        Source: gmpopenh264.dll.tmp.14.drString found in binary or memory: http://ocsp.thawte.com0
        Source: firefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
        Source: firefox.exe, 0000000E.00000003.2329037683.000001C87CEA5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.i.lencr.org/0
        Source: firefox.exe, 0000000E.00000003.2329037683.000001C87CEA5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.o.lencr.org0
        Source: gmpopenh264.dll.tmp.14.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
        Source: gmpopenh264.dll.tmp.14.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
        Source: gmpopenh264.dll.tmp.14.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
        Source: firefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
        Source: firefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
        Source: gmpopenh264.dll.tmp.14.drString found in binary or memory: http://www.mozilla.com0
        Source: firefox.exe, 0000000E.00000003.2399726836.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/2006/browser/search/
        Source: firefox.exe, 0000000E.00000003.2175972250.000001C8779C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
        Source: firefox.exe, 0000000E.00000003.2184230260.000001C8779C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175972250.000001C8779C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulp
        Source: firefox.exe, 00000017.00000003.2172102977.00000187C722C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3313525765.00000187C722C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2168589249.00000187C722C000.00000004.00000020.00020000.00000000.sdmp, mozilla-temp-41.14.drString found in binary or memory: http://www.videolan.org/x264.html
        Source: firefox.exe, 0000000E.00000003.2328593923.000001C87E831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2170899724.000001C87E833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2203891199.000001C87E831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183288473.000001C87CEA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2182398233.000001C87E819000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
        Source: firefox.exe, 0000000E.00000003.2328593923.000001C87E831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2170899724.000001C87E833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2203891199.000001C87E831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183288473.000001C87CEA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2182398233.000001C87E819000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://youtube.com/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2399726836.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
        Source: firefox.exe, 0000000E.00000003.2175377818.000001C87D2AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108861704.000001C875053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
        Source: firefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
        Source: firefox.exe, 0000000E.00000003.2327323546.000001C877BB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com
        Source: firefox.exe, 0000000E.00000003.2404349402.000001C8769C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321135125.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2355898745.000001C87E7A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/settings/clients
        Source: chromecache_211.25.drString found in binary or memory: https://accounts.google.com
        Source: chromecache_211.25.drString found in binary or memory: https://accounts.google.com/TOS?loc=
        Source: firefox.exe, 0000000E.00000003.2205344588.000001C87E72C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
        Source: firefox.exe, 0000000E.00000003.2205344588.000001C87E72C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwderIdL
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
        Source: firefox.exe, 0000000E.00000003.2405512676.000001C875DCD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ads-us.rd.linksynergy.com/as.php
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://amazon.com/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://api.accounts.firefox.com/v1
        Source: chromecache_206.25.drString found in binary or memory: https://apis.google.com/js/api.js
        Source: chromecache_211.25.drString found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
        Source: firefox.exe, 0000000E.00000003.2358448544.000001C87CE0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org
        Source: firefox.exe, 0000000E.00000003.2356744884.000001C87D321000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
        Source: firefox.exe, 0000000E.00000003.2329037683.000001C87CEE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2399345299.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183288473.000001C87CECA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321135125.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359661956.000001C87C982000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
        Source: firefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
        Source: firefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
        Source: firefox.exe, 0000000E.00000003.2333268550.000001C8779D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
        Source: firefox.exe, 0000000E.00000003.2292007603.000001C87F0A0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
        Source: firefox.exe, 0000000E.00000003.2202286972.000001C876C72000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
        Source: firefox.exe, 0000000E.00000003.2293029970.000001C87F0DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2295696316.000001C874AEF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
        Source: firefox.exe, 0000000E.00000003.2292007603.000001C87F0A0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
        Source: firefox.exe, 0000000E.00000003.2108861704.000001C875053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109188163.000001C87508A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
        Source: firefox.exe, 0000000E.00000003.2182853659.000001C87E78F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net
        Source: firefox.exe, 0000000E.00000003.2321135125.000001C87E78F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net/
        Source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359179309.000001C87CAC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2325974764.000001C87CAC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2356925179.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183288473.000001C87CE1D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://content.cdn.mozilla.net
        Source: firefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
        Source: firefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drString found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
        Source: firefox.exe, 0000000E.00000003.2357573398.000001C87CFFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com
        Source: firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/
        Source: firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tiles
        Source: firefox.exe, 0000000E.00000003.2356744884.000001C87D321000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tilesP
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://coverage.mozilla.org
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://crash-stats.mozilla.org/report/index/
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143659060.000001C87D068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/993268
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://dap-02.api.divviup.org
        Source: firefox.exe, 0000000E.00000003.2311806716.000001C876D08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://datastudio.google.com/embed/reporting/
        Source: firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
        Source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
        Source: firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
        Source: firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
        Source: firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
        Source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
        Source: firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
        Source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
        Source: firefox.exe, 0000000E.00000003.2279301102.000001C874ADD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143659060.000001C87D068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
        Source: firefox.exe, 0000000E.00000003.2183199056.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
        Source: firefox.exe, 0000000E.00000003.2182398233.000001C87E80B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?t=ffab&q=
        Source: firefox.exe, 0000000E.00000003.2150048740.000001C87D15D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/y
        Source: firefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286000311.000001C87227F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2290157985.000001C87227F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
        Source: firefox.exe, 0000000E.00000003.2286000311.000001C87227F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2290157985.000001C87227F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
        Source: firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
        Source: chromecache_211.25.drString found in binary or memory: https://families.google.com/intl/
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2325859840.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3307154018.000001D4C2B13000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
        Source: firefox.exe, 0000000E.00000003.2157746507.000001C87E557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2152321253.000001C87E557000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
        Source: firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
        Source: firefox.exe, 0000000E.00000003.2368966569.000001C876B52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/
        Source: firefox.exe, 0000000E.00000003.2318199395.000001C87E8C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
        Source: chromecache_211.25.drString found in binary or memory: https://g.co/recover
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2325859840.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3307154018.000001D4C2B13000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/
        Source: firefox.exe, 0000001D.00000002.3307154018.000001D4C2BC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
        Source: firefox.exe, 0000001D.00000002.3307154018.000001D4C2BC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
        Source: firefox.exe, 0000001D.00000002.3307154018.000001D4C2B30000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
        Source: firefox.exe, 0000001D.00000002.3307154018.000001D4C2BC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2325859840.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
        Source: firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
        Source: firefox.exe, 0000001D.00000002.3307154018.000001D4C2BC3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendations
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2325859840.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendationsS
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2325859840.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendationsS7
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2325859840.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143659060.000001C87D068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/closure-compiler/issues/3177
        Source: firefox.exe, 0000000E.00000003.2197551104.000001C87D1DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2147018425.000001C87D1DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2247570808.000001C87D1DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2292500569.000001C87D1DF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
        Source: firefox.exe, 0000000E.00000003.2197551104.000001C87D1DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2147018425.000001C87D1DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2247570808.000001C87D1DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2292500569.000001C87D1DF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/issues/1266
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
        Source: firefox.exe, 0000000E.00000003.2108861704.000001C875053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
        Source: firefox.exe, 0000000E.00000003.2362682979.000001C8770CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
        Source: firefox.exe, 0000000E.00000003.2325859840.000001C87CDAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184031519.000001C87CDAC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/zertosh/loose-envify)
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://ideas.mozilla.org/
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C87721A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/apps/relay
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
        Source: prefs-1.js.14.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
        Source: firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org
        Source: firefox.exe, 0000000E.00000003.2360036207.000001C878591000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878591000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3307154018.000001D4C2BF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit
        Source: firefox.exe, 0000000E.00000003.2327323546.000001C877BB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2407060237.000001C8758A3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/977a8611-6798-4b19-ac22-8362d
        Source: firefox.exe, 0000000E.00000003.2325664477.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320366285.000001C87E8C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318199395.000001C87E8C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/7755ad51-2370-4623-
        Source: firefox.exe, 0000000E.00000003.2407060237.000001C8758A3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/516ecd32-8db8-418d-81a9-0670
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2325859840.000001C87CD9A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submits
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://install.mozilla.org
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
        Source: firefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
        Source: firefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
        Source: firefox.exe, 0000000E.00000003.2311806716.000001C876D08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lookerstudio.google.com/embed/reporting/
        Source: firefox.exe, 0000000E.00000003.2286000311.000001C87227F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2290157985.000001C87227F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
        Source: firefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286000311.000001C87227F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2290157985.000001C87227F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%s
        Source: firefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286000311.000001C87227F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2290157985.000001C87227F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
        Source: firefox.exe, 0000001D.00000002.3307154018.000001D4C2B8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mitmdetection.services.mozilla.com/
        Source: firefox.exe, 0000000E.00000003.2225776339.000001C8749F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mochitest.youtube.com/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/about
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/breach-details/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/dashboard
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/preferences
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
        Source: firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mozilla.org0/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://oauth.accounts.firefox.com/v1
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ok.ru/
        Source: firefox.exe, 0000000E.00000003.2286000311.000001C87227F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2290157985.000001C87227F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
        Source: chromecache_211.25.drString found in binary or memory: https://play.google.com/log?format=json&hasfast=true
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
        Source: chromecache_211.25.drString found in binary or memory: https://play.google.com/work/enroll?identifier=
        Source: chromecache_211.25.drString found in binary or memory: https://play.google/intl/
        Source: firefox.exe, 0000000E.00000003.2200823580.000001C876DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274161893.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227059810.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2225776339.000001C8749F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://play.hbomax.com/page/
        Source: firefox.exe, 0000000E.00000003.2200823580.000001C876DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274161893.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227059810.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2225776339.000001C8749F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://play.hbomax.com/player/
        Source: firefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286000311.000001C87227F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2290157985.000001C87227F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
        Source: chromecache_211.25.drString found in binary or memory: https://policies.google.com/privacy
        Source: chromecache_211.25.drString found in binary or memory: https://policies.google.com/privacy/additional
        Source: chromecache_211.25.drString found in binary or memory: https://policies.google.com/privacy/google-partners
        Source: chromecache_211.25.drString found in binary or memory: https://policies.google.com/technologies/cookies
        Source: chromecache_211.25.drString found in binary or memory: https://policies.google.com/technologies/location-data
        Source: chromecache_211.25.drString found in binary or memory: https://policies.google.com/terms
        Source: chromecache_211.25.drString found in binary or memory: https://policies.google.com/terms/location
        Source: chromecache_211.25.drString found in binary or memory: https://policies.google.com/terms/service-specific
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://profile.accounts.firefox.com/v1
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com
        Source: firefox.exe, 0000000E.00000003.2324563637.000001C87CE67000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://push.services.mozilla.com
        Source: firefox.exe, 0000000E.00000003.2361570812.000001C877C04000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://push.services.mozilla.com/
        Source: firefox.exe, 0000000E.00000003.2184031519.000001C87CDAC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/api/v1/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
        Source: firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
        Source: firefox.exe, 0000000E.00000003.2279301102.000001C874ADD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
        Source: firefox.exe, 0000000E.00000003.2404171152.000001C8769DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
        Source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328593923.000001C87E81D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com
        Source: firefox.exe, 0000000E.00000003.2321356335.000001C87E77E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
        Source: firefox.exe, 0000000E.00000003.2205068681.000001C87E806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330355723.000001C87C993000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
        Source: firefox.exe, 0000000E.00000003.2406888585.000001C8758F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/play.svg
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
        Source: firefox.exe, 0000000E.00000003.2183199056.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com
        Source: firefox.exe, 0000000E.00000003.2182688273.000001C87E7BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3307154018.000001D4C2B13000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/
        Source: firefox.exe, 0000000E.00000003.2182688273.000001C87E7BC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs#
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs#l
        Source: firefox.exe, 0000001D.00000002.3307154018.000001D4C2BF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/user
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-password.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/animation/
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_device.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_pin.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_dark_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_dark_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_darkmode_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_darkmode_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_darkmode_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_darkmode_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_darkmode_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered_darkmode.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/usb_key.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/paaskey.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_phone.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_keys.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_dark_1.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_dark_2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set_darkmode.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_dark_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space_dark.png
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits_dark.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg
        Source: chromecache_206.25.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2_dark.svg
        Source: chromecache_211.25.drString found in binary or memory: https://support.google.com/accounts?hl=
        Source: chromecache_211.25.drString found in binary or memory: https://support.google.com/accounts?p=new-si-ui
        Source: chromecache_211.25.drString found in binary or memory: https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
        Source: firefox.exe, 0000000E.00000003.2368966569.000001C876B4A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
        Source: firefox.exe, 0000000E.00000003.2332730242.000001C877C0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2406662945.000001C875A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
        Source: firefox.exe, 0000000E.00000003.2400267741.000001C87CEEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEEE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
        Source: firefox.exe, 0000000E.00000003.2407060237.000001C8758A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2405156164.000001C87626F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/captive-portal
        Source: firefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
        Source: firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
        Source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
        Source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
        Source: firefox.exe, 0000000E.00000003.2381149367.000001C877AD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2245430964.000001C877AD4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
        Source: firefox.exe, 0000000E.00000003.2361453966.000001C877C89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2326077264.000001C877C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
        Source: firefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
        Source: firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
        Source: firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
        Source: firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
        Source: firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://topsites.services.mozilla.com/cid/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
        Source: firefox.exe, 0000000E.00000003.2183199056.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
        Source: chromecache_206.25.drString found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://vk.com/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
        Source: firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://webcompat.com/issues/new
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
        Source: firefox.exe, 0000000E.00000003.2325859840.000001C87CDAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184031519.000001C87CDAC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://webpack.js.org/concepts/mode/)
        Source: firefox.exe, 0000000E.00000003.2183288473.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324563637.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
        Source: firefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143659060.000001C87D068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
        Source: firefox.exe, 0000000E.00000003.2183199056.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
        Source: firefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
        Source: firefox.exe, 0000000E.00000003.2220491536.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196359191.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108861704.000001C875053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202286972.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321396962.000001C87E778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205068681.000001C87E806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205344588.000001C87E770000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2268723929.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2257809372.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109188163.000001C87508A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2282255017.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
        Source: firefox.exe, 0000000E.00000003.2183199056.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
        Source: firefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drString found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344423978.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344907446.000001C874DCE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2346421876.000001C874DC7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336072278.000001C874DD4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336224834.000001C874DD7000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.drString found in binary or memory: https://www.digicert.com/CPS0
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
        Source: chromecache_211.25.drString found in binary or memory: https://www.google.com
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
        Source: firefox.exe, 0000000E.00000003.2324121946.000001C87CF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2357676227.000001C87CF93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143450680.000001C87D041000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search
        Source: firefox.exe, 0000000E.00000003.2183199056.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108861704.000001C875053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109188163.000001C87508A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
        Source: chromecache_211.25.drString found in binary or memory: https://www.google.com/intl/
        Source: firefox.exe, 0000000E.00000003.2175274532.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202286972.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321396962.000001C87E778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205344588.000001C87E770000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2268723929.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2257809372.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109188163.000001C87508A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2282255017.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
        Source: firefox.exe, 0000000E.00000003.2182398233.000001C87E80B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
        Source: chromecache_206.25.drString found in binary or memory: https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif
        Source: chromecache_211.25.drString found in binary or memory: https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
        Source: firefox.exe, 0000000E.00000003.2200823580.000001C876DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274161893.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227059810.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2225776339.000001C8749F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.hulu.com/watch/
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
        Source: firefox.exe, 0000000E.00000003.2200823580.000001C876DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274161893.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227059810.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2225776339.000001C8749F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.instagram.com/
        Source: firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
        Source: firefox.exe, 0000000E.00000003.2356300891.000001C87D3E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368966569.000001C876B4A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
        Source: firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
        Source: firefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
        Source: firefox.exe, 0000000E.00000003.2157746507.000001C87E557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2152321253.000001C87E557000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C87724D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/anything/?
        Source: firefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
        Source: firefox.exe, 0000000E.00000003.2400267741.000001C87CEEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEEE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
        Source: firefox.exe, 0000000E.00000003.2406300585.000001C875BA9000.00000004.00000800.00020000.00000000.sdmp, targeting.snapshot.json.tmp.14.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D3EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
        Source: firefox.exe, 0000000E.00000003.2400267741.000001C87CEEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEEE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
        Source: firefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
        Source: firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D3EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
        Source: firefox.exe, 00000010.00000002.3307524889.000002A25EEC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3307154018.000001D4C2BF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
        Source: firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
        Source: firefox.exe, 00000010.00000002.3307524889.000002A25EEC8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/G&
        Source: firefox.exe, 0000000E.00000003.2357676227.000001C87CFC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/V
        Source: firefox.exe, 00000017.00000002.3307371315.00000187C6AC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/YK
        Source: firefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
        Source: firefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
        Source: firefox.exe, 0000000E.00000003.2183288473.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324563637.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
        Source: firefox.exe, 0000000E.00000003.2183199056.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
        Source: firefox.exe, 0000000E.00000003.2360706003.000001C87854F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359661956.000001C87C982000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/
        Source: firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
        Source: firefox.exe, 0000000E.00000003.2183199056.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6A0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3307154018.000001D4C2B03000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
        Source: chromecache_211.25.drString found in binary or memory: https://www.youtube.com/t/terms?chromeless=1&hl=
        Source: firefox.exe, 0000000E.00000003.2183288473.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324563637.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/
        Source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
        Source: firefox.exe, 0000000E.00000003.2175972250.000001C8779C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://youtube.com
        Source: firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/
        Source: recovery.jsonlz4.tmp.14.drString found in binary or memory: https://youtube.com/account?=
        Source: firefox.exe, 0000001D.00000002.3305747787.000001D4C28C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.co
        Source: file.exe, 00000000.00000002.3303862059.00000000015D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/chal
        Source: firefox.exe, 0000001D.00000002.3304226703.000001D4C27DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3305747787.000001D4C28C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3304226703.000001D4C27D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
        Source: firefox.exe, 00000010.00000002.3306769200.000002A25EBDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd)B
        Source: firefox.exe, 0000000C.00000002.2091277843.000002964AB57000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2096915703.00000237649DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
        Source: firefox.exe, 00000010.00000002.3306769200.000002A25EBD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd=B
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2342486498.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2310136898.000001C874DC9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2310469611.000001C874DDC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2310136898.000001C874D75000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2310605893.000001C874DC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306769200.000002A25EBD0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3304839971.000002A25EAB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3303503495.00000187C66B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3304159189.00000187C67F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3305747787.000001D4C28C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3304226703.000001D4C27D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
        Source: chromecache_211.25.drString found in binary or memory: https://youtube.com/t/terms?gl=
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
        Source: unknownNetwork traffic detected: HTTP traffic on port 61522 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
        Source: unknownNetwork traffic detected: HTTP traffic on port 61568 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
        Source: unknownNetwork traffic detected: HTTP traffic on port 61602 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61509
        Source: unknownNetwork traffic detected: HTTP traffic on port 61580 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61545 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61622
        Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61623
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61503
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61624
        Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61504
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61625
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61626
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61506
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61627
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61507
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61628
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61508
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61629
        Source: unknownNetwork traffic detected: HTTP traffic on port 61648 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61625 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
        Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61621
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
        Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
        Source: unknownNetwork traffic detected: HTTP traffic on port 61659 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61672 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61512
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61633
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61513
        Source: unknownNetwork traffic detected: HTTP traffic on port 61557 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61634
        Source: unknownNetwork traffic detected: HTTP traffic on port 61511 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61514
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61635
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61515
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61636
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61516
        Source: unknownNetwork traffic detected: HTTP traffic on port 61614 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61637
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61517
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61638
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61518
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61639
        Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61519
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
        Source: unknownNetwork traffic detected: HTTP traffic on port 61591 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61630
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61510
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61631
        Source: unknownNetwork traffic detected: HTTP traffic on port 61683 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61511
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61632
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
        Source: unknownNetwork traffic detected: HTTP traffic on port 61637 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61671 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61694 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61510 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61523
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61644
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61524
        Source: unknownNetwork traffic detected: HTTP traffic on port 61533 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61645
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61646
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61526
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61647
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61527
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61648
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61528
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61649
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61529
        Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
        Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
        Source: unknownNetwork traffic detected: HTTP traffic on port 61592 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61640
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61520
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61641
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61521
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61642
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61522
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61643
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
        Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61569 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61626 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61601 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61544 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61534
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61655
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61535
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61656
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61536
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61657
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61537
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61658
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61538
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61659
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61539
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
        Source: unknownNetwork traffic detected: HTTP traffic on port 61660 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61650
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61530
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61651
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61531
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61652
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61532
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61653
        Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61533
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61654
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
        Source: unknownNetwork traffic detected: HTTP traffic on port 61593 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
        Source: unknownNetwork traffic detected: HTTP traffic on port 61635 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61707
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61708
        Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61658 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61558 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61700
        Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61703
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61704
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61706
        Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61682 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
        Source: unknownNetwork traffic detected: HTTP traffic on port 61521 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
        Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
        Source: unknownNetwork traffic detected: HTTP traffic on port 61603 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61581 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61693 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61509 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61706 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61624 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
        Source: unknownNetwork traffic detected: HTTP traffic on port 61532 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
        Source: unknownNetwork traffic detected: HTTP traffic on port 61570 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
        Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61520 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
        Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61608
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61609
        Source: unknownNetwork traffic detected: HTTP traffic on port 61543 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61600
        Source: unknownNetwork traffic detected: HTTP traffic on port 61508 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61601
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61602
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61603
        Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61604
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61605
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61606
        Source: unknownNetwork traffic detected: HTTP traffic on port 61613 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61607
        Source: unknownNetwork traffic detected: HTTP traffic on port 61707 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
        Source: unknownNetwork traffic detected: HTTP traffic on port 61669 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
        Source: unknownNetwork traffic detected: HTTP traffic on port 61571 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
        Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61619
        Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61636 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61670 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61611
        Source: unknownNetwork traffic detected: HTTP traffic on port 61582 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61612
        Source: unknownNetwork traffic detected: HTTP traffic on port 61559 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61613
        Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61614
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61615
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61616
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61617
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61618
        Source: unknownNetwork traffic detected: HTTP traffic on port 61647 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
        Source: unknownNetwork traffic detected: HTTP traffic on port 61681 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61610
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61590
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61591
        Source: unknownNetwork traffic detected: HTTP traffic on port 61639 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61589
        Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61640 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61581
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61582
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61583
        Source: unknownNetwork traffic detected: HTTP traffic on port 61577 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61584
        Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61585
        Source: unknownNetwork traffic detected: HTTP traffic on port 61663 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61586
        Source: unknownNetwork traffic detected: HTTP traffic on port 61554 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61587
        Source: unknownNetwork traffic detected: HTTP traffic on port 61686 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61588
        Source: unknownNetwork traffic detected: HTTP traffic on port 61628 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61651 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61588 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61697 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61592
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61593
        Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61594
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61595
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61596
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61597
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61598
        Source: unknownNetwork traffic detected: HTTP traffic on port 61536 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61599
        Source: unknownNetwork traffic detected: HTTP traffic on port 61652 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61604 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61589 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61566 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61524 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61547 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61617 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
        Source: unknownNetwork traffic detected: HTTP traffic on port 61708 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
        Source: unknownNetwork traffic detected: HTTP traffic on port 61674 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61513 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61555 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
        Source: unknownNetwork traffic detected: HTTP traffic on port 61685 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61606 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61696 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61673 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61650 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61545
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61666
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61546
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61667
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61547
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61668
        Source: unknownNetwork traffic detected: HTTP traffic on port 61512 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61548
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61669
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61549
        Source: unknownNetwork traffic detected: HTTP traffic on port 61615 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61590 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61660
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61540
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61661
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61541
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61662
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61542
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61663
        Source: unknownNetwork traffic detected: HTTP traffic on port 61535 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61543
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61664
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61544
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61665
        Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61546 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61567 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61638 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61556
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61677
        Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61557
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61678
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61558
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61679
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61559
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61670
        Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61550
        Source: unknownNetwork traffic detected: HTTP traffic on port 61578 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61662 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61671
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61551
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61672
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61552
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61673
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61553
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61674
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61554
        Source: unknownNetwork traffic detected: HTTP traffic on port 61649 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61675
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61555
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61676
        Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61627 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61690
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61567
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61688
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61568
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61689
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61569
        Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61579 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61680
        Source: unknownNetwork traffic detected: HTTP traffic on port 61684 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61560
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61681
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61561
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61682
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61562
        Source: unknownNetwork traffic detected: HTTP traffic on port 61661 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61683
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61563
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61684
        Source: unknownNetwork traffic detected: HTTP traffic on port 61556 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61564
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61685
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61565
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61686
        Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61566
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61687
        Source: unknownNetwork traffic detected: HTTP traffic on port 61605 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61523 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61580
        Source: unknownNetwork traffic detected: HTTP traffic on port 61695 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61534 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61578
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61579
        Source: unknownNetwork traffic detected: HTTP traffic on port 61616 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61570
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61691
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61571
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61692
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61572
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61693
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61573
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61694
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61574
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61695
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61575
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61696
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61576
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61697
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61577
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 61698
        Source: unknownNetwork traffic detected: HTTP traffic on port 61654 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61597 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61631 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61677 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61619 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61539 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61516 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61607 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61504 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61563 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61666 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61574 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61665 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61552 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61575 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61688 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 61632 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49718 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49722 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49738 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49742 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49822 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49834 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49833 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61507 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:61510 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 52.222.236.23:443 -> 192.168.2.5:61509 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:61517 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61518 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61519 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61520 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:61550 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:61630 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61687 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61688 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61693 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61694 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:61696 version: TLS 1.2
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0013EAFF
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0013ED6A
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0013EAFF
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_0012AA57
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00159576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00159576

        System Summary

        barindex
        Binary is likely a compiled AutoIt script file
        Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.
        Source: file.exe, 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_990c6a34-c
        Source: file.exe, 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_7a5e1e6c-e
        Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_80f4948f-2
        Source: file.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_a18ab06c-a
        Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 23_2_00000187C69E2377 NtQuerySystemInformation,23_2_00000187C69E2377
        Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 23_2_00000187C70671F2 NtQuerySystemInformation,23_2_00000187C70671F2
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012D5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_0012D5EB
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00121201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00121201
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_0012E8F6
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001320460_2_00132046
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000C80600_2_000C8060
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001282980_2_00128298
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000FE4FF0_2_000FE4FF
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000F676B0_2_000F676B
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001548730_2_00154873
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000ECAA00_2_000ECAA0
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000CCAF00_2_000CCAF0
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000DCC390_2_000DCC39
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000F6DD90_2_000F6DD9
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000DB1190_2_000DB119
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000C91C00_2_000C91C0
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E13940_2_000E1394
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E17060_2_000E1706
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E781B0_2_000E781B
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000C79200_2_000C7920
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000D997D0_2_000D997D
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E19B00_2_000E19B0
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E7A4A0_2_000E7A4A
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E1C770_2_000E1C77
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E7CA70_2_000E7CA7
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0014BE440_2_0014BE44
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000F9EEE0_2_000F9EEE
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E1F320_2_000E1F32
        Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 23_2_00000187C69E237723_2_00000187C69E2377
        Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 23_2_00000187C70671F223_2_00000187C70671F2
        Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 23_2_00000187C706723223_2_00000187C7067232
        Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 23_2_00000187C706791C23_2_00000187C706791C
        Source: C:\Users\user\Desktop\file.exeCode function: String function: 000C9CB3 appears 31 times
        Source: C:\Users\user\Desktop\file.exeCode function: String function: 000DF9F2 appears 40 times
        Source: C:\Users\user\Desktop\file.exeCode function: String function: 000E0A30 appears 46 times
        Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        Source: classification engineClassification label: mal76.troj.evad.winEXE@76/71@65/19
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001337B5 GetLastError,FormatMessageW,0_2_001337B5
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001210BF AdjustTokenPrivileges,CloseHandle,0_2_001210BF
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001216C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_001216C3
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001351CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_001351CD
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_0012D4DC
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_0013648E
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000C42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_000C42A2
        Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246Jump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
        Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Local\Temp\firefoxJump to behavior
        Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
        Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
        Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: firefox.exe, 0000000E.00000003.2362682979.000001C87707C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
        Source: firefox.exe, 0000000E.00000003.2368966569.000001C876B3C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT sum(count) FROM events;
        Source: file.exeReversingLabs: Detection: 15%
        Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
        Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
        Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
        Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
        Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
        Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2116 -prefMapHandle 2088 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6173e676-c43b-4cb8-a736-2d8aff0db5d2} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c864f6f710 socket
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
        Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
        Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
        Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4484 -parentBuildID 20230927232528 -prefsHandle 4212 -prefMapHandle 4428 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8da78f2-518e-408c-bcad-9b17924570ea} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c864f7b310 rdd
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5440 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4964 -prefMapHandle 3712 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c73dd90-851d-4d9d-9772-142af10aaa4f} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c87e79d710 utility
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blockingJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobarsJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blockingJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2116 -prefMapHandle 2088 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6173e676-c43b-4cb8-a736-2d8aff0db5d2} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c864f6f710 socketJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4484 -parentBuildID 20230927232528 -prefsHandle 4212 -prefMapHandle 4428 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8da78f2-518e-408c-bcad-9b17924570ea} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c864f7b310 rddJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4964 -prefMapHandle 3712 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c73dd90-851d-4d9d-9772-142af10aaa4f} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c87e79d710 utilityJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8Jump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5440 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8Jump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8Jump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: wsock32.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
        Source: Google Drive.lnk.24.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
        Source: YouTube.lnk.24.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
        Source: Sheets.lnk.24.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
        Source: Gmail.lnk.24.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
        Source: Slides.lnk.24.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
        Source: Docs.lnk.24.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
        Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
        Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
        Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
        Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
        Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: Binary string: UxTheme.pdb source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358419025.000001C87CE1A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: rsaenh.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wininet.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wshbth.pdbGCTL source: firefox.exe, 0000000E.00000003.2355303915.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: kbdus.pdb source: firefox.exe, 0000000E.00000003.2344423978.000001C874DF3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344798677.000001C874DF4000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2C4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: bcrypt.pdb source: firefox.exe, 0000000E.00000003.2359661956.000001C87C982000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359329721.000001C87CA8A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: rpcrt4.pdb source: firefox.exe, 0000000E.00000003.2358711945.000001C87CD53000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: pnrpnsp.pdb source: firefox.exe, 0000000E.00000003.2355945891.000001C87E74C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2353194945.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321439169.000001C87E74C000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wshbth.pdb source: firefox.exe, 0000000E.00000003.2355303915.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ktmw32.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: NapiNSP.pdb source: firefox.exe, 0000000E.00000003.2349251170.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: msvcrt.pdb source: firefox.exe, 0000000E.00000003.2329875068.000001C87CAB4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: xWindows.StateRepositoryPS.pdb source: firefox.exe, 0000000E.00000003.2324563637.000001C87CE67000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: xOneCoreUAPCommonProxyStub.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2C4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: webauthn.pdbGCTL source: firefox.exe, 0000000E.00000003.2353902486.000001C87FD01000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: xul.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: crypt32.pdbjTx source: firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: shcore.pdb source: firefox.exe, 0000000E.00000003.2329037683.000001C87CEC2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: mozglue.pdb source: firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: winnsi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: cryptsp.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: sspicli.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: CLBCatQ.pdb source: firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ntmarta.pdb source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE39000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000E.00000003.2349251170.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: dnsapi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: nlaapi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: firefox.pdb source: firefox.exe, 0000000E.00000003.2330491155.000001C878526000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: winhttp.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: netprofm.pdb source: firefox.exe, 0000000E.00000003.2348901211.000001C87FD01000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: msimg32.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wsock32.pdbP4 source: firefox.exe, 0000000E.00000003.2357676227.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324121946.000001C87CF9F000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ntasn1.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: win32u.pdb source: firefox.exe, 0000000E.00000003.2325664477.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358605369.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: netprofm.pdbUGP source: firefox.exe, 0000000E.00000003.2348901211.000001C87FD01000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: firefox.pdb source: firefox.exe, 0000000E.00000003.2330491155.000001C878526000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: dbghelp.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: imm32.pdb source: firefox.exe, 0000000E.00000003.2358419025.000001C87CE1A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: webauthn.pdb source: firefox.exe, 0000000E.00000003.2353902486.000001C87FD01000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: gdi32.pdb source: firefox.exe, 0000000E.00000003.2325664477.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358605369.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358419025.000001C87CE1A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: profapi.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ws2_32.pdb source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF41000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: avrt.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: WLDP.pdb source: firefox.exe, 0000000E.00000003.2324563637.000001C87CEB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEC2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: mswsock.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: sechost.pdb source: firefox.exe, 0000000E.00000003.2358711945.000001C87CD53000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: shell32.pdbe source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE39000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: nsi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: propsys.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: twinapi.pdb@b source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.14.dr
        Source: Binary string: winmm.pdb source: firefox.exe, 0000000E.00000003.2356583871.000001C87D368000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: winrnr.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: msctf.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: version.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ole32.pdb source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF41000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: dbgcore.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: kbdus.pdbGCTL source: firefox.exe, 0000000E.00000003.2344423978.000001C874DF3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2344798677.000001C874DF4000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: user32.pdb source: firefox.exe, 0000000E.00000003.2325664477.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358605369.000001C87CDF4000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: twinapi.pdb source: firefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: msasn1.pdb source: firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.14.dr
        Source: Binary string: psapi.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: DWrite.pdb source: firefox.exe, 0000000E.00000003.2356618652.000001C87D34E000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ntdll.pdb source: firefox.exe, 0000000E.00000003.2360774664.000001C87853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: combase.pdb source: firefox.exe, 0000000E.00000003.2358419025.000001C87CE1A000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: pnrpnsp.pdbUGP source: firefox.exe, 0000000E.00000003.2353194945.000001C874DA1000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: shell32.pdbP4 source: firefox.exe, 0000000E.00000003.2329732520.000001C87CE39000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: ncrypt.pdb source: firefox.exe, 0000000E.00000003.2360036207.000001C87858D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2330491155.000001C87858D000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: nss3.pdb source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF41000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wsock32.pdb source: firefox.exe, 0000000E.00000003.2358243877.000001C87CF41000.00000004.00000800.00020000.00000000.sdmp
        Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
        Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
        Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
        Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
        Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_000C42DE
        Source: gmpopenh264.dll.tmp.14.drStatic PE information: section name: .rodata
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E0A76 push ecx; ret 0_2_000E0A89
        Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpJump to dropped file
        Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)Jump to dropped file
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000DF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_000DF98E
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00151C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00151C41
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion

        barindex
        Found API chain indicative of sandbox detection
        Source: C:\Users\user\Desktop\file.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-97919
        Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 23_2_00000187C69E2377 rdtsc 23_2_00000187C69E2377
        Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 4283Jump to behavior
        Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 4965Jump to behavior
        Source: C:\Users\user\Desktop\file.exeWindow / User API: foregroundWindowGot 1355Jump to behavior
        Source: C:\Users\user\Desktop\file.exeAPI coverage: 4.0 %
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_0012DBBE
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000FC2A2 FindFirstFileExW,0_2_000FC2A2
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001368EE FindFirstFileW,FindClose,0_2_001368EE
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_0013698F
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0012D076
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0012D3A9
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00139642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00139642
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0013979D
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00139B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00139B2B
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00135C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00135C97
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_000C42DE
        Source: firefox.exe, 0000001D.00000002.3304226703.000001D4C27DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW6
        Source: firefox.exe, 00000017.00000002.3311390892.00000187C6F60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ
        Source: firefox.exe, 00000010.00000002.3313251646.000002A25F340000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWB!U
        Source: firefox.exe, 0000000E.00000003.2336269357.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2342486498.000001C8667D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306769200.000002A25EBDA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313251646.000002A25F340000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3311390892.00000187C6F60000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3306204760.000001D4C28D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
        Source: firefox.exe, 00000010.00000002.3311892014.000002A25EF1E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
        Source: firefox.exe, 00000010.00000002.3313251646.000002A25F340000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWXB
        Source: firefox.exe, 00000017.00000002.3311390892.00000187C6F60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
        Source: firefox.exe, 00000017.00000002.3303503495.00000187C66BA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@c
        Source: firefox.exe, 00000010.00000002.3313251646.000002A25F340000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3311390892.00000187C6F60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
        Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

        Anti Debugging

        barindex
        Found API chain indicative of debugger detection
        Source: C:\Users\user\Desktop\file.exeDebugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleepgraph_0-98562
        Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 23_2_00000187C69E2377 rdtsc 23_2_00000187C69E2377
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0013EAA2 BlockInput,0_2_0013EAA2
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_000F2622
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_000C42DE
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E4CE8 mov eax, dword ptr fs:[00000030h]0_2_000E4CE8
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00120B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00120B62
        Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_000F2622
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_000E083F
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E09D5 SetUnhandledExceptionFilter,0_2_000E09D5
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_000E0C21
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00121201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00121201
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00102BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00102BA5
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0012B226 SendInput,keybd_event,0_2_0012B226
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_001422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_001422DA
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /TJump to behavior
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00120B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00120B62
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00121663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00121663
        Source: file.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
        Source: file.exeBinary or memory string: Shell_TrayWnd
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000E0698 cpuid 0_2_000E0698
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00138195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_00138195
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0011D27A GetUserNameW,0_2_0011D27A
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000FB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,0_2_000FB952
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_000C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_000C42DE

        Stealing of Sensitive Information

        barindex
        Yara detected Credential Flusher
        Source: Yara matchFile source: 00000000.00000003.2053297015.00000000015C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.3303862059.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: file.exe PID: 7272, type: MEMORYSTR
        Source: file.exeBinary or memory string: WIN_81
        Source: file.exeBinary or memory string: WIN_XP
        Source: file.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
        Source: file.exeBinary or memory string: WIN_XPe
        Source: file.exeBinary or memory string: WIN_VISTA
        Source: file.exeBinary or memory string: WIN_7
        Source: file.exeBinary or memory string: WIN_8

        Remote Access Functionality

        barindex
        Yara detected Credential Flusher
        Source: Yara matchFile source: 00000000.00000003.2053297015.00000000015C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.3303862059.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: file.exe PID: 7272, type: MEMORYSTR
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00141204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_00141204
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00141806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00141806

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire Infrastructure2
        Valid Accounts        		1
        Windows Management Instrumentation        		1
        DLL Side-Loading        		1
        Exploitation for Privilege Escalation        		2
        Disable or Modify Tools        		21
        Input Capture        		2
        System Time Discovery        		Remote Services1
        Archive Collected Data        		2
        Ingress Tool Transfer        		Exfiltration Over Other Network Medium1
        System Shutdown/Reboot
        CredentialsDomainsDefault Accounts1
        Native API        		2
        Valid Accounts        		1
        DLL Side-Loading        		1
        Deobfuscate/Decode Files or Information        		LSASS Memory1
        Account Discovery        		Remote Desktop Protocol21
        Input Capture        		11
        Encrypted Channel        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt1
        Registry Run Keys / Startup Folder        		1
        Extra Window Memory Injection        		2
        Obfuscated Files or Information        		Security Account Manager2
        File and Directory Discovery        		SMB/Windows Admin Shares3
        Clipboard Data        		3
        Non-Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
        Valid Accounts        		1
        DLL Side-Loading        		NTDS16
        System Information Discovery        		Distributed Component Object ModelInput Capture4
        Application Layer Protocol        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
        Access Token Manipulation        		1
        Extra Window Memory Injection        		LSA Secrets231
        Security Software Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts2
        Process Injection        		1
        Masquerading        		Cached Domain Credentials2
        Virtualization/Sandbox Evasion        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
        Registry Run Keys / Startup Folder        		2
        Valid Accounts        		DCSync3
        Process Discovery        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job2
        Virtualization/Sandbox Evasion        		Proc Filesystem11
        Application Window Discovery        		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
        Access Token Manipulation        		/etc/passwd and /etc/shadow1
        System Owner/User Discovery        		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
        IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron2
        Process Injection        		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1529402 Sample: file.exe Startdate: 09/10/2024 Architecture: WINDOWS Score: 76 48 youtube.com 2->48 50 us-west1.prod.sumo.prod.webservices.mozgcp.net 2->50 52 25 other IPs or domains 2->52 70 Multi AV Scanner detection for submitted file 2->70 72 Yara detected Credential Flusher 2->72 74 Binary is likely a compiled AutoIt script file 2->74 76 2 other signatures 2->76 8 file.exe 2->8         started        11 firefox.exe 1 2->11         started        signatures3 process4 signatures5 78 Binary is likely a compiled AutoIt script file 8->78 80 Found API chain indicative of debugger detection 8->80 82 Found API chain indicative of sandbox detection 8->82 13 chrome.exe 9 8->13         started        16 taskkill.exe 1 8->16         started        18 taskkill.exe 1 8->18         started        23 7 other processes 8->23 20 firefox.exe 3 214 11->20         started        process6 dnsIp7 60 192.168.2.5, 443, 49326, 49405 unknown unknown 13->60 62 239.255.255.250 unknown Reserved 13->62 25 chrome.exe 13->25         started        40 2 other processes 13->40 28 conhost.exe 16->28         started        30 conhost.exe 18->30         started        64 youtube.com 142.250.181.238, 443, 49712, 49713 GOOGLEUS United States 20->64 66 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49714, 49717, 49728 GOOGLEUS United States 20->66 68 10 other IPs or domains 20->68 44 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 20->44 dropped 46 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 20->46 dropped 32 firefox.exe 1 20->32         started        34 firefox.exe 1 20->34         started        36 firefox.exe 20->36         started        38 conhost.exe 23->38         started        42 5 other processes 23->42 file8 process9 dnsIp10 54 142.250.184.206, 443, 49724 GOOGLEUS United States 25->54 56 play.google.com 142.250.186.142, 443, 49795, 49797 GOOGLEUS United States 25->56 58 7 other IPs or domains 25->58

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        file.exe16%ReversingLabs
        file.exe100%Joe Sandbox ML

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)0%ReversingLabs
        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp0%ReversingLabs

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.0%URL Reputationsafe
        https://policies.google.com/terms/service-specific0%URL Reputationsafe
        https://policies.google.com/technologies/cookies0%URL Reputationsafe
        https://apis.google.com/js/api.js0%URL Reputationsafe
        https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL0%URL Reputationsafe
        https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref0%URL Reputationsafe
        https://policies.google.com/privacy0%URL Reputationsafe
        https://login.microsoftonline.com0%URL Reputationsafe
        http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
        http://x1.c.lencr.org/00%URL Reputationsafe
        http://x1.i.lencr.org/00%URL Reputationsafe
        https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage0%URL Reputationsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        example.org
        		93.184.215.14
        		truefalse
          		unknown
          prod.classify-client.prod.webservices.mozgcp.net
          		35.190.72.216
          		truefalse
            		unknown
            prod.balrog.prod.cloudops.mozgcp.net
            		35.244.181.201
            		truefalse
              		unknown
              prod.detectportal.prod.cloudops.mozgcp.net
              		34.107.221.82
              		truefalse
                		unknown
                services.addons.mozilla.org
                		52.222.236.23
                		truefalse
                  		unknown
                  prod.remote-settings.prod.webservices.mozgcp.net
                  		34.149.100.209
                  		truefalse
                    		unknown
                    contile.services.mozilla.com
                    		34.117.188.166
                    		truefalse
                      		unknown
                      youtube.com
                      		142.250.181.238
                      		truefalse
                        		unknown
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        		34.160.144.191
                        		truefalse
                          		unknown
                          youtube-ui.l.google.com
                          		142.250.185.238
                          		truefalse
                            		unknown
                            www3.l.google.com
                            		142.250.186.46
                            		truefalse
                              		unknown
                              us-west1.prod.sumo.prod.webservices.mozgcp.net
                              		34.149.128.2
                              		truefalse
                                		unknown
                                play.google.com
                                		142.250.186.142
                                		truefalse
                                  		unknown
                                  ipv4only.arpa
                                  		192.0.0.171
                                  		truefalse
                                    		unknown
                                    prod.ads.prod.webservices.mozgcp.net
                                    		34.117.188.166
                                    		truefalse
                                      		unknown
                                      push.services.mozilla.com
                                      		34.107.243.93
                                      		truefalse
                                        		unknown
                                        www.google.com
                                        		172.217.18.4
                                        		truefalse
                                          		unknown
                                          normandy-cdn.services.mozilla.com
                                          		35.201.103.21
                                          		truefalse
                                            		unknown
                                            telemetry-incoming.r53-2.services.mozilla.com
                                            		34.120.208.123
                                            		truefalse
                                              		unknown
                                              spocs.getpocket.com
                                              		unknown
                                              		unknownfalse
                                                		unknown
                                                content-signature-2.cdn.mozilla.net
                                                		unknown
                                                		unknownfalse
                                                  		unknown
                                                  support.mozilla.org
                                                  		unknown
                                                  		unknownfalse
                                                    		unknown
                                                    firefox.settings.services.mozilla.com
                                                    		unknown
                                                    		unknownfalse
                                                      		unknown
                                                      www.youtube.com
                                                      		unknown
                                                      		unknownfalse
                                                        		unknown
                                                        detectportal.firefox.com
                                                        		unknown
                                                        		unknownfalse
                                                          		unknown
                                                          normandy.cdn.mozilla.net
                                                          		unknown
                                                          		unknownfalse
                                                            		unknown
                                                            accounts.youtube.com
                                                            		unknown
                                                            		unknownfalse
                                                              		unknown
                                                              shavar.services.mozilla.com
                                                              		unknown
                                                              		unknownfalse
                                                                		unknown

                                                                Contacted URLs

                                                                NameMaliciousAntivirus DetectionReputation
                                                                https://www.google.com/favicon.icofalse
                                                                  		unknown

                                                                  URLs from Memory and Binaries

                                                                  NameSourceMaliciousAntivirus DetectionReputation
                                                                  https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lfirefox.exe, 0000001D.00000002.3307154018.000001D4C2BC3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://detectportal.firefox.com/firefox.exe, 0000000E.00000003.2182688273.000001C87E7BC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://datastudio.google.com/embed/reporting/firefox.exe, 0000000E.00000003.2311806716.000001C876D08000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://www.mozilla.com0gmpopenh264.dll.tmp.14.drfalse
                                                                              		unknown
                                                                              https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecyclfirefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143659060.000001C87D068000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.firefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://merino.services.mozilla.com/api/v1/suggestfirefox.exe, 0000001D.00000002.3307154018.000001D4C2B8E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://play.google.com/work/enroll?identifier=chromecache_211.25.drfalse
                                                                                    		unknown
                                                                                    https://policies.google.com/terms/service-specificchromecache_211.25.drfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protectfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://www.leboncoin.fr/firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://policies.google.com/technologies/cookieschromecache_211.25.drfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        https://spocs.getpocket.com/spocsfirefox.exe, 0000000E.00000003.2182688273.000001C87E7BC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozillfirefox.exe, 0000000E.00000003.2183199056.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2ED000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://shavar.services.mozilla.comfirefox.exe, 0000000E.00000003.2319183281.000001C87E819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328593923.000001C87E81D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://completion.amazon.com/search/complete?q=firefox.exe, 0000000E.00000003.2108861704.000001C875053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109188163.000001C87508A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-reportfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tabfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://monitor.firefox.com/breach-details/firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEMfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://www.youtube.com/t/terms?chromeless=1&hl=chromecache_211.25.drfalse
                                                                                                          		unknown
                                                                                                          https://xhr.spec.whatwg.org/#sync-warningfirefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://www.amazon.com/exec/obidos/external-search/firefox.exe, 0000000E.00000003.2220491536.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196359191.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108861704.000001C875053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202286972.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321396962.000001C87E778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205068681.000001C87E806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205344588.000001C87E770000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2268723929.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2257809372.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109188163.000001C87508A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2282255017.000001C876CE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://www.msn.comfirefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://github.com/mozilla-services/screenshotsfirefox.exe, 0000000E.00000003.2108861704.000001C875053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109032975.000001C87506F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108585540.000001C875038000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108238885.000001C874E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2108411279.000001C87501D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://services.addons.mozilla.org/api/v4/addons/addon/firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://tracking-protection-issues.herokuapp.com/newfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-reportfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://youtube.com/firefox.exe, 0000000E.00000003.2330491155.000001C878538000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://content-signature-2.cdn.mozilla.net/firefox.exe, 0000000E.00000003.2321135125.000001C87E78F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=htfirefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingfirefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://www.instagram.com/firefox.exe, 0000000E.00000003.2200823580.000001C876DEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274161893.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227059810.000001C8749F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2225776339.000001C8749F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-reportfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://api.accounts.firefox.com/v1firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://apis.google.com/js/api.jschromecache_206.25.drfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      		unknown
                                                                                                                                      https://ok.ru/firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://www.amazon.com/firefox.exe, 0000000E.00000003.2183199056.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullScfirefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protectionsfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                http://win.mail.ru/cgi-bin/sentmsg?mailto=%sfirefox.exe, 0000000E.00000003.2272143853.000001C870D7D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://www.youtube.com/firefox.exe, 0000000E.00000003.2183199056.000001C87D2E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6A0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3307154018.000001D4C2B03000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shieldfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://MD8.mozilla.org/1/mfirefox.exe, 0000000E.00000003.2175274532.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2399726836.000001C87D2C7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://www.bbc.co.uk/firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://addons.mozilla.org/firefox/addon/to-google-translate/firefox.exe, 0000000E.00000003.2361823857.000001C877281000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=firefox.exe, 0000001D.00000002.3307154018.000001D4C2BC3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://127.0.0.1:firefox.exe, 0000000E.00000003.2182765006.000001C87E796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2399345299.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321135125.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205171631.000001C87E78D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359661956.000001C87C982000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2405953520.000001C875D53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2172021862.000001C87E795000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://bugzilla.mozilla.org/show_bug.cgi?id=1266220firefox.exe, 0000000E.00000003.2292007603.000001C87F0A0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152firefox.exe, 0000000E.00000003.2279301102.000001C874ADD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://bugzilla.mofirefox.exe, 0000000E.00000003.2333268550.000001C8779D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://mitmdetection.services.mozilla.com/firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://youtube.com/account?=recovery.jsonlz4.tmp.14.drfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://shavar.services.mozilla.com/firefox.exe, 0000000E.00000003.2321356335.000001C87E77E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBLfirefox.exe, 0000000E.00000003.2362682979.000001C87704C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&reffirefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://policies.google.com/privacychromecache_211.25.drfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477firefox.exe, 00000010.00000002.3307524889.000002A25EEE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311776276.000001D4C2D03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.drfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapturefirefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://spocs.getpocket.com/firefox.exe, 0000000E.00000003.2182688273.000001C87E7BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3307371315.00000187C6A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3307154018.000001D4C2B13000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://services.addons.mozilla.org/api/v4/abuse/report/addon/firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-ffirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://www.iqiyi.com/firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          https://youtube.com/account?=https://accounts.google.cofirefox.exe, 0000001D.00000002.3305747787.000001D4C28C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_rfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              https://monitor.firefox.com/user/breach-stats?includeResolved=truefirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-reportfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  http://a9.com/-/spec/opensearch/1.0/firefox.exe, 0000000E.00000003.2399726836.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYiprefs-1.js.14.drfalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      https://safebrowsing.google.com/safebrowsing/diagnostic?site=firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        https://monitor.firefox.com/user/dashboardfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_IDfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                            https://monitor.firefox.com/aboutfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              http://mozilla.org/MPL/2.0/.firefox.exe, 0000000E.00000003.2242755035.000001C874E9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2379857345.000001C8749EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197551104.000001C87D1DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210277720.000001C874AE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2375602286.000001C874E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329536974.000001C87CE5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305530700.000001C8751A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2221377640.000001C874A48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2145571847.000001C87D0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2386744316.000001C8722FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279301102.000001C874ADD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227059810.000001C8749D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307224519.000001C8722F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2114379885.000001C8751A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328204760.000001C87796A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2371008508.000001C8751A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2407406877.000001C8756CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210277720.000001C874AD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2404755287.000001C8762CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2281997658.000001C874AD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2408759298.000001C876C9C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                https://account.bellmedia.cfirefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  http://youtube.com/firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                    https://login.microsoftonline.comfirefox.exe, 0000000E.00000003.2330491155.000001C878594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2360036207.000001C878594000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                    https://coverage.mozilla.orgfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                      http://crl.thawte.com/ThawteTimestampingCA.crl0gmpopenh264.dll.tmp.14.drfalse
                                                                                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                      https://www.zhihu.com/firefox.exe, 0000000E.00000003.2183288473.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2405953520.000001C875D74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329037683.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2324563637.000001C87CEBB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                        http://x1.c.lencr.org/0firefox.exe, 0000000E.00000003.2328593923.000001C87E831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2170899724.000001C87E833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2203891199.000001C87E831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183288473.000001C87CEA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2182398233.000001C87E819000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                        http://x1.i.lencr.org/0firefox.exe, 0000000E.00000003.2328593923.000001C87E831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2170899724.000001C87E833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2203891199.000001C87E831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183288473.000001C87CEA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2182398233.000001C87E819000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                        http://a9.com/-/spec/opensearch/1.1/firefox.exe, 0000000E.00000003.2399726836.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2328817821.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2175274532.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2183199056.000001C87D2D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                          https://infra.spec.whatwg.org/#ascii-whitespacefirefox.exe, 0000000E.00000003.2243730502.000001C87D067000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148556063.000001C87D061000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302968857.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2383536138.000001C87D05E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256906614.000001C87D064000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                                            https://blocked.cdn.mozilla.net/firefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                                              https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnoredfirefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                                https://json-schema.org/draft/2019-09/schemafirefox.exe, 0000000E.00000003.2323303771.000001C87D381000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                                  http://developer.mozilla.org/en/docs/DOM:element.addEventListenerfirefox.exe, 0000000E.00000003.2358243877.000001C87CF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2176949604.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2368540818.000001C876B9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2184559806.000001C876B9C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    https://duckduckgo.com/?t=ffab&q=firefox.exe, 0000000E.00000003.2182398233.000001C87E80B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      https://profiler.firefox.comfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                        https://outlook.live.com/default.aspx?rru=compose&to=%sfirefox.exe, 0000000E.00000003.2286000311.000001C87227F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2290157985.000001C87227F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                                          https://identity.mozilla.com/apps/relayfirefox.exe, 0000000E.00000003.2361823857.000001C87721A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                                                            https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessagechromecache_211.25.drfalse
                                                                                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                                                            https://mozilla.cloudflare-dns.com/dns-queryfirefox.exe, 00000010.00000002.3306518541.000002A25EB70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3305782942.00000187C6960000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000002.3311281760.000001D4C2C00000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                                                              https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2firefox.exe, 0000000E.00000003.2361453966.000001C877C89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2326077264.000001C877C85000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                		unknown

                                                                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                                                                                                Public IPs

                                                                                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                                                142.250.186.46
                                                                                                                                                                                                                                                		www3.l.google.comUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                142.250.181.238
                                                                                                                                                                                                                                                		youtube.comUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                34.117.188.166
                                                                                                                                                                                                                                                		contile.services.mozilla.comUnited States
                                                                                                                                                                                                                                                		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                                                                                52.222.236.23
                                                                                                                                                                                                                                                		services.addons.mozilla.orgUnited States
                                                                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                                                                35.201.103.21
                                                                                                                                                                                                                                                		normandy-cdn.services.mozilla.comUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                142.250.184.206
                                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                34.120.208.123
                                                                                                                                                                                                                                                		telemetry-incoming.r53-2.services.mozilla.comUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                172.217.18.4
                                                                                                                                                                                                                                                		www.google.comUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                34.149.100.209
                                                                                                                                                                                                                                                		prod.remote-settings.prod.webservices.mozgcp.netUnited States
                                                                                                                                                                                                                                                		2686ATGS-MMD-ASUSfalse
                                                                                                                                                                                                                                                34.107.243.93
                                                                                                                                                                                                                                                		push.services.mozilla.comUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                34.107.221.82
                                                                                                                                                                                                                                                		prod.detectportal.prod.cloudops.mozgcp.netUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                216.58.206.46
                                                                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                35.244.181.201
                                                                                                                                                                                                                                                		prod.balrog.prod.cloudops.mozgcp.netUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                239.255.255.250
                                                                                                                                                                                                                                                		unknownReserved
                                                                                                                                                                                                                                                		unknownunknownfalse
                                                                                                                                                                                                                                                142.250.186.142
                                                                                                                                                                                                                                                		play.google.comUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                35.190.72.216
                                                                                                                                                                                                                                                		prod.classify-client.prod.webservices.mozgcp.netUnited States
                                                                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                34.160.144.191
                                                                                                                                                                                                                                                		prod.content-signature-chains.prod.webservices.mozgcp.netUnited States
                                                                                                                                                                                                                                                		2686ATGS-MMD-ASUSfalse

                                                                                                                                                                                                                                                Private

                                                                                                                                                                                                                                                IP
                                                                                                                                                                                                                                                192.168.2.5
                                                                                                                                                                                                                                                127.0.0.1

                                                                                                                                                                                                                                                General Information

                                                                                                                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                                                Analysis ID:1529402
                                                                                                                                                                                                                                                Start date and time:2024-10-09 00:03:07 +02:00
                                                                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                                                Overall analysis duration:0h 7m 43s
                                                                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                                                Number of analysed new started processes analysed:32
                                                                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                                                                Sample name:file.exe
                                                                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                                                                Classification:mal76.troj.evad.winEXE@76/71@65/19
                                                                                                                                                                                                                                                EGA Information:
                                                                                                                                                                                                                                                • Successful, ratio: 50%
                                                                                                                                                                                                                                                HCA Information:
                                                                                                                                                                                                                                                • Successful, ratio: 96%
                                                                                                                                                                                                                                                • Number of executed functions: 43
                                                                                                                                                                                                                                                • Number of non-executed functions: 309
                                                                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                                                                • Found application associated with file extension: .exe

                                                                                                                                                                                                                                                Warnings

                                                                                                                                                                                                                                                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                                                                                • Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.110.84, 142.250.185.238, 34.104.35.123, 44.224.63.42, 44.242.27.108, 44.238.148.23, 199.232.210.172, 142.250.186.74, 216.58.212.170, 172.217.16.138, 142.250.185.74, 142.250.184.234, 142.250.186.106, 142.250.181.234, 216.58.212.138, 172.217.16.202, 142.250.186.138, 142.250.185.138, 142.250.186.170, 216.58.206.74, 172.217.18.10, 142.250.184.202, 142.250.186.42, 172.217.16.195, 192.229.221.95, 142.250.185.67, 142.250.185.170, 172.217.23.106, 216.58.206.42, 142.250.185.106, 142.250.185.202, 142.250.185.234, 172.217.18.106, 172.217.16.206, 2.22.61.56, 2.22.61.59, 216.58.212.142, 172.217.18.3, 199.232.214.172
                                                                                                                                                                                                                                                • Excluded domains from analysis (whitelisted): ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, clientservices.googleapis.com, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, a19.dscg10.akamai.net, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, update.googleapis.com, safebrowsing.googleapis.com, www.gstatic.com, optimizationguide-pa.googleapis.com, www.bing.com, clients1.google.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com, location.services.mozilla.com
                                                                                                                                                                                                                                                • HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
                                                                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                                                                • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                                                                • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                                                                • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                                                                • VT rate limit hit for: file.exe

                                                                                                                                                                                                                                                Simulations

                                                                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                                                                18:04:22API Interceptor1x Sleep call for process: firefox.exe modified

                                                                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                                                                IPs

                                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                34.117.188.166file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                            file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                    52.222.236.23file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                            file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                    http://www.aieov.com/setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                      7U5e5iJPJ0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                        239.255.255.250shelbycountytn.gov.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                            https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                              https://paa9eki.fitutend.com/p0wh/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFnDa0TAMLVO9WtBTyYEZqZA-3DPrnv_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOmYNN4Eos0I-2F5FhDJBI4w4qadztSYeu4ugOMJrD5ZJ3NK5HbR-2B5js4EjZpFmlZJIJ2eepX0b1t3SsV5gyIJGc7CJjeC8X5Wxzv49-2FqOYJzl5qBXpr-2BWwAW7G6cWDOqZN4YK73LjV4xBBNvL9fcHX0SM3SHQjbhXBuKD0dh5WqiuRgt8l7OsZEvxy8UkJaur7KIBjJyVTij7zCSJnYd6mjsUFQl8fAjX9eSOEGKjy2XWh8GHa2xi9VgTVCxGMcn7gM-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                  original.emlGet hashmaliciousHtmlDropperBrowse
                                                                                                                                                                                                                                                                                                    https://www-washingtoncountyinsider-com.webpkgcache.com/doc/-/s/www.washingtoncountyinsider.com//Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                      Illustrator_Set-Up.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                        PrintDriver_x64.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                          https://keepass.info/news/n240601_2.57.html#v1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            34.149.100.209file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                            file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse

                                                                                                                                                                                                                                                                                                                                Domains

                                                                                                                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                                                                prod.remote-settings.prod.webservices.mozgcp.netfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                services.addons.mozilla.orgfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.120
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.120
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 18.245.162.100
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.120
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.48
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.120
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.80
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.120
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.48
                                                                                                                                                                                                                                                                                                                                contile.services.mozilla.comfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                example.orgfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 93.184.215.14

                                                                                                                                                                                                                                                                                                                                ASNs

                                                                                                                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                                                                GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                Remittance_Regulvar.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.239.71
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                                                                                                                ATGS-MMD-ASUSfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.254.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                https://shoutout.wix.com/so/68P9j4pbc/c?w=YIpy_LmKpeOuRTcqEasLgbctjTenhex96yD397bZU04.eyJ1IjoiaHR0cHM6Ly9maWxlc3NoYXJlcy5naXRodWIuaW8vYXJ1dHkvIiwiciI6IjU3ZWU5MDNjLTU1YjktNDMxYS0zNDRiLWUzZjYxNjRhN2I0MiIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.206.255
                                                                                                                                                                                                                                                                                                                                Remittance_Regulvar.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.236.64
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                AMAZON-02USfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.215.95.29
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.120
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.120
                                                                                                                                                                                                                                                                                                                                https://paa9eki.fitutend.com/p0wh/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 18.193.37.153
                                                                                                                                                                                                                                                                                                                                https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFnDa0TAMLVO9WtBTyYEZqZA-3DPrnv_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOmYNN4Eos0I-2F5FhDJBI4w4qadztSYeu4ugOMJrD5ZJ3NK5HbR-2B5js4EjZpFmlZJIJ2eepX0b1t3SsV5gyIJGc7CJjeC8X5Wxzv49-2FqOYJzl5qBXpr-2BWwAW7G6cWDOqZN4YK73LjV4xBBNvL9fcHX0SM3SHQjbhXBuKD0dh5WqiuRgt8l7OsZEvxy8UkJaur7KIBjJyVTij7zCSJnYd6mjsUFQl8fAjX9eSOEGKjy2XWh8GHa2xi9VgTVCxGMcn7gM-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 13.224.189.17
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 18.245.162.100
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.120
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 52.222.236.48
                                                                                                                                                                                                                                                                                                                                Illustrator_Set-Up.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 18.245.60.45
                                                                                                                                                                                                                                                                                                                                ATGS-MMD-ASUSfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.254.14
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                https://shoutout.wix.com/so/68P9j4pbc/c?w=YIpy_LmKpeOuRTcqEasLgbctjTenhex96yD397bZU04.eyJ1IjoiaHR0cHM6Ly9maWxlc3NoYXJlcy5naXRodWIuaW8vYXJ1dHkvIiwiciI6IjU3ZWU5MDNjLTU1YjktNDMxYS0zNDRiLWUzZjYxNjRhN2I0MiIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.149.206.255
                                                                                                                                                                                                                                                                                                                                Remittance_Regulvar.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.236.64
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191

                                                                                                                                                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                                                                1138de370e523e824bbca92d049a3777https://keepass.info/news/n240601_2.57.html#v1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                SecuriteInfo.com.Trojan.DownLoader47.43477.29852.19410.exeGet hashmaliciousLummaC, VidarBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                https://salesf54b.myportfolio.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                https://1drv.ms/w/c/3e7c84f1a590a3e6/IQStDJr3bMEwQZDK5oU6uNI1AXa25ZxVanY0bWjgRrRk-d4Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                Y1ZqkGzvKm.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                Y1ZqkGzvKm.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                EY10AIvC8B.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                EY10AIvC8B.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                https://www.google.com.bo/url?url=https://coqjcqixwpeuzndc&hpj=jguragr&fwbtzg=qoe&ffzzf=olnshn&aes=fvotjnl&garqe=txbrxc&emrj=ycbtmrgd&uwzlcgsurn=eygnbnharg&q=amp/jhjn24u.v%C2%ADvg%C2%ADzy%C2%ADnp%C2%ADe%C2%ADw%C2%ADl%C2%ADkkukl.com%E2%80%8B/4b3puorbt&vijx=zlglfoj&qcobrch=pupf&cjaim=omgedz&guneqiu=xqm&d=DwMFAgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, VidarBrowse
                                                                                                                                                                                                                                                                                                                                • 23.1.237.91
                                                                                                                                                                                                                                                                                                                                28a2c9bd18a11de089ef85a160da29e4file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                https://paa9eki.fitutend.com/p0wh/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFnDa0TAMLVO9WtBTyYEZqZA-3DPrnv_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOmYNN4Eos0I-2F5FhDJBI4w4qadztSYeu4ugOMJrD5ZJ3NK5HbR-2B5js4EjZpFmlZJIJ2eepX0b1t3SsV5gyIJGc7CJjeC8X5Wxzv49-2FqOYJzl5qBXpr-2BWwAW7G6cWDOqZN4YK73LjV4xBBNvL9fcHX0SM3SHQjbhXBuKD0dh5WqiuRgt8l7OsZEvxy8UkJaur7KIBjJyVTij7zCSJnYd6mjsUFQl8fAjX9eSOEGKjy2XWh8GHa2xi9VgTVCxGMcn7gM-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                https://www-washingtoncountyinsider-com.webpkgcache.com/doc/-/s/www.washingtoncountyinsider.com//Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                PrintDriver_x64.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                https://keepass.info/news/n240601_2.57.html#v1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                https://shoutout.wix.com/so/68P9j4pbc/c?w=YIpy_LmKpeOuRTcqEasLgbctjTenhex96yD397bZU04.eyJ1IjoiaHR0cHM6Ly9maWxlc3NoYXJlcy5naXRodWIuaW8vYXJ1dHkvIiwiciI6IjU3ZWU5MDNjLTU1YjktNDMxYS0zNDRiLWUzZjYxNjRhN2I0MiIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                Remittance_Regulvar.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                                                • 4.175.87.197
                                                                                                                                                                                                                                                                                                                                • 184.28.90.27
                                                                                                                                                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                                                                                                                                                fb0aa01abe9d8e4037eb3473ca6e2dcafile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123
                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                • 35.244.181.201
                                                                                                                                                                                                                                                                                                                                • 34.149.100.209
                                                                                                                                                                                                                                                                                                                                • 34.160.144.191
                                                                                                                                                                                                                                                                                                                                • 52.222.236.23
                                                                                                                                                                                                                                                                                                                                • 34.120.208.123

                                                                                                                                                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                            file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                            file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse

                                                                                                                                                                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                                                                                                                                                                        C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_2faf6fc0-31d6-41d2-a7f5-9e0f96ead40b.json (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):7813
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.178087307796598
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:192:7KMXLHwcbhbVbTbfbRbObtbyEl7ncrqJA6wnSrDtTkd/S5:7P8cNhnzFSJ8r5jnSrDhkd/M
                                                                                                                                                                                                                                                                                                                                                                        MD5:C31BCC0809E2BC88AF369010F14A77F2
                                                                                                                                                                                                                                                                                                                                                                        SHA1:1CF4B508D51880065FC5ADB678E066970AA55BF5
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:9028E1702337D3A087AE0B21A2F8F08F8D69892CEEB042397B4929D6B25334E9
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:D4A1461915176D247E71149778189BF38DFE3D413922360CD11B96514B42ED57966248756B9022E3668818F76A9A4B0A0A6F0794C115A48F74FFCFC974BE2A0F
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"type":"uninstall","id":"2faf6fc0-31d6-41d2-a7f5-9e0f96ead40b","creationDate":"2024-10-08T23:13:04.133Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                                                                                                                                                                                                                        C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_2faf6fc0-31d6-41d2-a7f5-9e0f96ead40b.json.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):7813
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.178087307796598
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:192:7KMXLHwcbhbVbTbfbRbObtbyEl7ncrqJA6wnSrDtTkd/S5:7P8cNhnzFSJ8r5jnSrDhkd/M
                                                                                                                                                                                                                                                                                                                                                                        MD5:C31BCC0809E2BC88AF369010F14A77F2
                                                                                                                                                                                                                                                                                                                                                                        SHA1:1CF4B508D51880065FC5ADB678E066970AA55BF5
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:9028E1702337D3A087AE0B21A2F8F08F8D69892CEEB042397B4929D6B25334E9
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:D4A1461915176D247E71149778189BF38DFE3D413922360CD11B96514B42ED57966248756B9022E3668818F76A9A4B0A0A6F0794C115A48F74FFCFC974BE2A0F
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"type":"uninstall","id":"2faf6fc0-31d6-41d2-a7f5-9e0f96ead40b","creationDate":"2024-10-08T23:13:04.133Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):32768
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.4593089050301797
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                                                                                                                                                                                                                                                                                                                                        MD5:D910AD167F0217587501FDCDB33CC544
                                                                                                                                                                                                                                                                                                                                                                        SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmpaddon

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):453023
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.997718157581587
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
                                                                                                                                                                                                                                                                                                                                                                        MD5:85430BAED3398695717B0263807CF97C
                                                                                                                                                                                                                                                                                                                                                                        SHA1:FFFBEE923CEA216F50FCE5D54219A188A5100F41
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 21:04:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):2677
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.9801611994430646
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:8NMdgoTAsluSH5idAKZdA19ehwiZUklqehGfy+3:8Mfthfy
                                                                                                                                                                                                                                                                                                                                                                        MD5:6A0BDB282CFEB4942E156DAB14AFB0C7
                                                                                                                                                                                                                                                                                                                                                                        SHA1:9EC72166729BEBB980E7E84B8104AD359F1B4CC6
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:6636A4FEE3AAC9C2449AF7A6A0B898A26F4402954DD8170452729E4921257F7E
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:93721E16E074960052944124DC1846574130933285D3C588AC38E5AEAE4F99BD9EF80C4D9AB40B352E4F0597E299CE21928B75973CABE582DBE82F5DBF962E10
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:L..................F.@.. ...$+.,....F;t.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 21:04:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):2679
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.9960084876490947
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:8HMdgoTAsluSH5idAKZdA1weh/iZUkAQkqehRfy+2:8OfH9QEfy
                                                                                                                                                                                                                                                                                                                                                                        MD5:4F72F3F93B71C85F374346DD8EA614FD
                                                                                                                                                                                                                                                                                                                                                                        SHA1:E414381836EA53D1598D23BDE97859DE79CEFA28
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:4F00B3B33FB302184FF96F171711D8899F8D2D5773DE3377E4EAEBD22191B51E
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:F44EFE19CF8B214C97106B817471050313CE0C16434A0FF298404943477E1AE691BFA96B1A7BB938555CDC882C0CCD59C01747B76C21A2828328643773733871
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:L..................F.@.. ...$+.,....g.V.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):2693
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.008176948547959
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:8xsMdgoTAslsH5idAKZdA14tseh7sFiZUkmgqeh7sHfy+BX:8xRfInVfy
                                                                                                                                                                                                                                                                                                                                                                        MD5:1618A3F098FD37916993D938FAA6D949
                                                                                                                                                                                                                                                                                                                                                                        SHA1:04EF4A0327C0B97B5BE7307AC7241ACF5F6FDF3D
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:B4560ACCD9B0DA34E2825CEEF8F708A76261A4B15BDAF82798BACEDA29F856D6
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:8A058AB2A63F5F028390678197B48EF655287E85047DFF8AAA8B94C8EFAA4B3E3FB79014688E651446C52A337D22350B4517D90B4CB47BF345E82C91434F3B4F
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 21:04:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):2681
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.995150995529447
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:8cMdgoTAsluSH5idAKZdA1vehDiZUkwqehdfy+R:8BfkPfy
                                                                                                                                                                                                                                                                                                                                                                        MD5:8A20E4B40416D2C3063F65B172259F4B
                                                                                                                                                                                                                                                                                                                                                                        SHA1:1F3F3B992DC969A759779C011495A8FBD441DA09
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:4E0B7A34853BA91197CCF77658F68E71DD608F6455AAAC72CF69AB2B09393CD1
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:A2956F5BC1276B034B8E80CF2FA50ADD615E4D1180954F6844FA3F5FFA1DEDDE65484D606183706B64DE5BF8F431A96511CD8D104040D619C39AA76FE9391CEC
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:L..................F.@.. ...$+.,....:=G.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 21:04:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):2681
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.984933567334849
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:8xMdgoTAsluSH5idAKZdA1hehBiZUk1W1qeh7fy+C:8wfk9bfy
                                                                                                                                                                                                                                                                                                                                                                        MD5:8B773CBD0EFC209D69911A79BD26AF72
                                                                                                                                                                                                                                                                                                                                                                        SHA1:FA4CA161FE071472AD5F078F00D667553E1BEC91
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:A470C9F0C243A8FE4D7D3E7BE2888FBA3B3537ACCF7885ADD8F1641AFF95E5F6
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:05F295FC8159985340EB2105F88E93E50519683AD37F3B5A924947E8B31F9BF27310672267A55F4D3DE5E054C00AC4DC374778A47E12694AAFFD6E8B72C0A5BC
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:L..................F.@.. ...$+.,....6]f.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 21:04:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):2683
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.993971315880111
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:8P8MdgoTAsluSH5idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbVfy+yT+:8PhfKT/TbxWOvTbVfy7T
                                                                                                                                                                                                                                                                                                                                                                        MD5:481560694824CF7E665170B012D11CBE
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C00EAC5268E7900DBAE871D77EEA41FAB36FE069
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:A76C31874823FCC45F8BC4D5258C1410CDBED8C9591B6968033F443AA9BB9CE4
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:F9C33010DA67FD9D8E45247E4FAA6A75705487428172F70708873B4CCFF6D8ACB337893BB50EA75B4B99AF558A02BF820D36574EEFB7D75E218E950209EF1933
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:L..................F.@.. ...$+.,....Y,3.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):3621
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.921498771438585
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakN194xeln:8S+OVPUFRbOdwNIOdYpjvY1Q6L+m8P
                                                                                                                                                                                                                                                                                                                                                                        MD5:1F9E4866C69413DAE4095F789C19C646
                                                                                                                                                                                                                                                                                                                                                                        SHA1:97ADCDD5BF614C6ADFE3D0A2E13764D2CF1F723F
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:6D559F66E2BFA664662599AA118967DFD75B8E4AC050B12417DC3132FEE81C96
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:ED584EC9F278E4F411A8DDB23503BD16C01C26B9B0C22EDF061D87490E76BA4AA6310EFC483426D45491FD9E01883FEE3ED05F174CB62AAA0E424FC68CB00287
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):3621
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.921498771438585
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakN194xeln:8S+OVPUFRbOdwNIOdYpjvY1Q6L+m8P
                                                                                                                                                                                                                                                                                                                                                                        MD5:1F9E4866C69413DAE4095F789C19C646
                                                                                                                                                                                                                                                                                                                                                                        SHA1:97ADCDD5BF614C6ADFE3D0A2E13764D2CF1F723F
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:6D559F66E2BFA664662599AA118967DFD75B8E4AC050B12417DC3132FEE81C96
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:ED584EC9F278E4F411A8DDB23503BD16C01C26B9B0C22EDF061D87490E76BA4AA6310EFC483426D45491FD9E01883FEE3ED05F174CB62AAA0E424FC68CB00287
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Mozilla lz4 compressed data, originally 22422 bytes
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):5308
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.599374203470186
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
                                                                                                                                                                                                                                                                                                                                                                        MD5:EB56C2F4DA9435F3D5574161F414CD17
                                                                                                                                                                                                                                                                                                                                                                        SHA1:74A8FC3EC0559740FD9D835B638354985E2DEAB6
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Mozilla lz4 compressed data, originally 22422 bytes
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):5308
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.599374203470186
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
                                                                                                                                                                                                                                                                                                                                                                        MD5:EB56C2F4DA9435F3D5574161F414CD17
                                                                                                                                                                                                                                                                                                                                                                        SHA1:74A8FC3EC0559740FD9D835B638354985E2DEAB6
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):24
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.91829583405449
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                                                                                                                                                                                                                        MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"schema":6,"addons":[]}

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):24
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.91829583405449
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                                                                                                                                                                                                                        MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"schema":6,"addons":[]}

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):262144
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.04905141882491872
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
                                                                                                                                                                                                                                                                                                                                                                        MD5:8736A542C5564A922C47B19D9CC5E0F2
                                                                                                                                                                                                                                                                                                                                                                        SHA1:CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4 (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):66
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.837595020998689
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                                                                                                                                                                                                                        MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                                                                                                                                                                                                                        SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):66
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.837595020998689
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                                                                                                                                                                                                                        MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                                                                                                                                                                                                                        SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):36830
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.1867463390487
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
                                                                                                                                                                                                                                                                                                                                                                        MD5:98875950B62B398FFE70C0A8D0998017
                                                                                                                                                                                                                                                                                                                                                                        SHA1:CFCFFF938402E53D341FE392E25D2E6C557E548F
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):36830
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.1867463390487
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
                                                                                                                                                                                                                                                                                                                                                                        MD5:98875950B62B398FFE70C0A8D0998017
                                                                                                                                                                                                                                                                                                                                                                        SHA1:CFCFFF938402E53D341FE392E25D2E6C557E548F
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):32768
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                                                                                                                                                        MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                                                                                                                                                        SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):1021904
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.648417932394748
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                                                                                                                                                                                                                                                                                                        MD5:FE3355639648C417E8307C6D051E3E37
                                                                                                                                                                                                                                                                                                                                                                        SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):1021904
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.648417932394748
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                                                                                                                                                                                                                                                                                                        MD5:FE3355639648C417E8307C6D051E3E37
                                                                                                                                                                                                                                                                                                                                                                        SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):116
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.968220104601006
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                                                                                                                                                                                                                                                                                                        MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                                                                                                                                                                                                                                                                                                        SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):116
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.968220104601006
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                                                                                                                                                                                                                                                                                                        MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                                                                                                                                                                                                                                                                                                        SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):32768
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.035699946889726504
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:GtlstFwfeHIQDCscZlYlltlstFwfeHIQDCscZ/D89//alEl:GtWtylQe9ZGtWtylQe9Z789XuM
                                                                                                                                                                                                                                                                                                                                                                        MD5:BC458E3E6F14B8E21896E69D3B307183
                                                                                                                                                                                                                                                                                                                                                                        SHA1:D94F6E58FDA4D7E5E669D8E90F20EF9C8B217D28
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:935EA4B828DF267FA2DABEB14BD1A98215F8FE73A123B6B8FF7A50B3BC8D88DD
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:F7289F66DB6B3C8233F68BB5C8C7E6476048E1FEF96E4C34B3B4C480DE9D45A85F97D4DF21246967AA0DC1B96C029B3999107D01AF7A1F22E9181E91C4F8BB1A
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:..-.........................V..v..$.:]...W...9...-.........................V..v..$.:]...W...9.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):32824
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.03976477547000166
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:Ol1YzIQIqfC7RiC3X7l8rEXsxdwhml8XW3R2:KGzIQIFRiC3rl8dMhm93w
                                                                                                                                                                                                                                                                                                                                                                        MD5:9BCBC817C1708889EBF5725A19F8F76F
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C2021C4C3C79895637A83DD65DC476C5B71D6C3A
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:1A258B75D948CA86202EC0C53D8C51DDDD4B05FA8FC67C2D68BEBB84D3905DB4
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:378106E3009E9DE2B965E69DC7BDE56E1C7D50DA13F5F754EB6C9C9E78F9795082D8298D830029974806803E7CD38C46282BA61DF048878DABD719550FF7ADA0
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:7....-............$.:]..O................$.:].....v.V................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1743), with CRLF line terminators
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):13187
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.476270968018323
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:192:OnPOeRnLYbBp6mJ0aX+f6SEXKNlNWZ5RHWNBw8d7Sl:kDerJUiIv+HEwU0
                                                                                                                                                                                                                                                                                                                                                                        MD5:6871310E770B007CFE6F3AF6DEA30C83
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C7FD4756D70E34665FDDA8C2C52FE500676EC743
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:3CC19CC52416EA93F3A7115E4A55F4DF92F76C5C822E4FD8A6C8402E94E5BC5A
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:62B4374C8D93A32EB15824BCB9B6F817EC40B29C103832D7E9C1233F055591AD754563FF251922C7C134F8739D8BBA5FFB9C60621B47AA61320F5AB041A1E3AB
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1728429154);..user_pref("app.update.lastUpdateTime.background-update-timer", 1728429154);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1728429154);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172842

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1743), with CRLF line terminators
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):13187
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.476270968018323
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:192:OnPOeRnLYbBp6mJ0aX+f6SEXKNlNWZ5RHWNBw8d7Sl:kDerJUiIv+HEwU0
                                                                                                                                                                                                                                                                                                                                                                        MD5:6871310E770B007CFE6F3AF6DEA30C83
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C7FD4756D70E34665FDDA8C2C52FE500676EC743
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:3CC19CC52416EA93F3A7115E4A55F4DF92F76C5C822E4FD8A6C8402E94E5BC5A
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:62B4374C8D93A32EB15824BCB9B6F817EC40B29C103832D7E9C1233F055591AD754563FF251922C7C134F8739D8BBA5FFB9C60621B47AA61320F5AB041A1E3AB
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1728429154);..user_pref("app.update.lastUpdateTime.background-update-timer", 1728429154);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1728429154);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172842

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.04062825861060003
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
                                                                                                                                                                                                                                                                                                                                                                        MD5:60C09456D6362C6FBED48C69AA342C3C
                                                                                                                                                                                                                                                                                                                                                                        SHA1:58B6E22DAA48C75958B429F662DEC1C011AE74D3
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\ac549893-2ba3-4e6e-8c5f-69f758ed9a9b (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):493
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.966637731056944
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:12:YZFgcEW5AkIVHlW8cOlZGV1AQIYzvZcyBuLZGAvxn:YD5NSlCOlZGV1AQIWZcy6ZXvx
                                                                                                                                                                                                                                                                                                                                                                        MD5:2522209B0FBB246E5C2791006455731D
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C021CCB825426B2BF4741D08E9D04573ED3DE669
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:06E25790E47F4862CA734EB971E3B4EB8EAA6AFC83F5D05A5F61E02F4140479A
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:ED05B1757D8713195D7C621ED60090A96D47A06C8479F47C81793169AFC6098D55B1EC4D3096BC300C6349A9FED80B0A7D96A8659298D13F494B290771210FF4
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"type":"health","id":"ac549893-2ba3-4e6e-8c5f-69f758ed9a9b","creationDate":"2024-10-08T23:13:04.827Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\ac549893-2ba3-4e6e-8c5f-69f758ed9a9b.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):493
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.966637731056944
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:12:YZFgcEW5AkIVHlW8cOlZGV1AQIYzvZcyBuLZGAvxn:YD5NSlCOlZGV1AQIWZcy6ZXvx
                                                                                                                                                                                                                                                                                                                                                                        MD5:2522209B0FBB246E5C2791006455731D
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C021CCB825426B2BF4741D08E9D04573ED3DE669
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:06E25790E47F4862CA734EB971E3B4EB8EAA6AFC83F5D05A5F61E02F4140479A
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:ED05B1757D8713195D7C621ED60090A96D47A06C8479F47C81793169AFC6098D55B1EC4D3096BC300C6349A9FED80B0A7D96A8659298D13F494B290771210FF4
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"type":"health","id":"ac549893-2ba3-4e6e-8c5f-69f758ed9a9b","creationDate":"2024-10-08T23:13:04.827Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):90
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.194538242412464
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                                                                                                                                                                                                                        MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                                                                                                                                                                                                                        SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):90
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.194538242412464
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                                                                                                                                                                                                                        MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                                                                                                                                                                                                                        SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.baklz4 (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Mozilla lz4 compressed data, originally 5862 bytes
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):1549
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.331898534941257
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:24:vkSUGlcAxSalLXleUGR9FxzhzT5s3sGggENHHVpjBMruhWjT/c0BO6m0Bt6fuQ:cpOxzheUGDzvEfggqHrjKr/Y6O6BtU
                                                                                                                                                                                                                                                                                                                                                                        MD5:FCD2B98B3C2564169BDD3C1A0555BFA6
                                                                                                                                                                                                                                                                                                                                                                        SHA1:D05E816BAFF84F88851102CCED43AA4EBB58554F
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:0629404D1EDE6E6461C25AE8E206DE47E59A99939B26D4B4A82890117DD0941E
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:4C6C347379B0F17367442FC1B40DA64E8322F430C720BD19FCA9C2C929F04F96E7866C4E3CB0D7BACA9B84010FF0D34BEB5F9748318ACA9AD064B9F9E5D39A5C
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{21ba1e16-75f9-4138-995c-b72ccead8718}","resultPrincipalURI":null,"hasUserInteracte...false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1728429159995,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedT[.@],"_...C..`GroupCG..":-1,"busy...t...Flags":2150633470....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace:...98952893-68ff-4a5d-a164-705c709ed3db","zD..1...Wn..l........k..:....1":{..jUpdate...7,"startTim..P23350...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..a"taarI|.Recure...,a.Donly..fexpiry...35911,"originA...."firs

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Mozilla lz4 compressed data, originally 5862 bytes
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):1549
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.331898534941257
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:24:vkSUGlcAxSalLXleUGR9FxzhzT5s3sGggENHHVpjBMruhWjT/c0BO6m0Bt6fuQ:cpOxzheUGDzvEfggqHrjKr/Y6O6BtU
                                                                                                                                                                                                                                                                                                                                                                        MD5:FCD2B98B3C2564169BDD3C1A0555BFA6
                                                                                                                                                                                                                                                                                                                                                                        SHA1:D05E816BAFF84F88851102CCED43AA4EBB58554F
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:0629404D1EDE6E6461C25AE8E206DE47E59A99939B26D4B4A82890117DD0941E
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:4C6C347379B0F17367442FC1B40DA64E8322F430C720BD19FCA9C2C929F04F96E7866C4E3CB0D7BACA9B84010FF0D34BEB5F9748318ACA9AD064B9F9E5D39A5C
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{21ba1e16-75f9-4138-995c-b72ccead8718}","resultPrincipalURI":null,"hasUserInteracte...false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1728429159995,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedT[.@],"_...C..`GroupCG..":-1,"busy...t...Flags":2150633470....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace:...98952893-68ff-4a5d-a164-705c709ed3db","zD..1...Wn..l........k..:....1":{..jUpdate...7,"startTim..P23350...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..a"taarI|.Recure...,a.Donly..fexpiry...35911,"originA...."firs

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Mozilla lz4 compressed data, originally 5862 bytes
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):1549
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.331898534941257
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:24:vkSUGlcAxSalLXleUGR9FxzhzT5s3sGggENHHVpjBMruhWjT/c0BO6m0Bt6fuQ:cpOxzheUGDzvEfggqHrjKr/Y6O6BtU
                                                                                                                                                                                                                                                                                                                                                                        MD5:FCD2B98B3C2564169BDD3C1A0555BFA6
                                                                                                                                                                                                                                                                                                                                                                        SHA1:D05E816BAFF84F88851102CCED43AA4EBB58554F
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:0629404D1EDE6E6461C25AE8E206DE47E59A99939B26D4B4A82890117DD0941E
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:4C6C347379B0F17367442FC1B40DA64E8322F430C720BD19FCA9C2C929F04F96E7866C4E3CB0D7BACA9B84010FF0D34BEB5F9748318ACA9AD064B9F9E5D39A5C
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{21ba1e16-75f9-4138-995c-b72ccead8718}","resultPrincipalURI":null,"hasUserInteracte...false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1728429159995,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedT[.@],"_...C..`GroupCG..":-1,"busy...t...Flags":2150633470....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace:...98952893-68ff-4a5d-a164-705c709ed3db","zD..1...Wn..l........k..:....1":{..jUpdate...7,"startTim..P23350...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..a"taarI|.Recure...,a.Donly..fexpiry...35911,"originA...."firs

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):4096
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):2.0836444556178684
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
                                                                                                                                                                                                                                                                                                                                                                        MD5:8B40B1534FF0F4B533AF767EB5639A05
                                                                                                                                                                                                                                                                                                                                                                        SHA1:63EDB539EA39AD09D701A36B535C4C087AE08CC9
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json (copy)

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):4537
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.030025429905255
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:96:ycJMTEr5/lLmI2Ac1zzcxvbw6Kkgrc2Rn27:0TEr5NX0z3DhRe
                                                                                                                                                                                                                                                                                                                                                                        MD5:A037EDFEF265D16576EDE902B7D5EAD6
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C5D248A1785630574BA1F8CBA346D894D503D744
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:14340F81B28F17936CDA19BCFA0C6899568ED01B8E3C8732348B64E0D569B046
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:9EDABF9BF1D65A23DDCE385E70B50177F79DD0CACBB9FE266EA03BFD7BC8C9C378EA0C8341F538D325BBBDA5EEC4911F475F2B959784CDB20FBCA0C346DE23AE
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-08T23:12:26.665Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

                                                                                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.tmp

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):4537
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.030025429905255
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:96:ycJMTEr5/lLmI2Ac1zzcxvbw6Kkgrc2Rn27:0TEr5NX0z3DhRe
                                                                                                                                                                                                                                                                                                                                                                        MD5:A037EDFEF265D16576EDE902B7D5EAD6
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C5D248A1785630574BA1F8CBA346D894D503D744
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:14340F81B28F17936CDA19BCFA0C6899568ED01B8E3C8732348B64E0D569B046
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:9EDABF9BF1D65A23DDCE385E70B50177F79DD0CACBB9FE266EA03BFD7BC8C9C378EA0C8341F538D325BBBDA5EEC4911F475F2B959784CDB20FBCA0C346DE23AE
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        Preview:{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-08T23:12:26.665Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 205

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):5430
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.6534652184263736
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
                                                                                                                                                                                                                                                                                                                                                                        MD5:F3418A443E7D841097C714D69EC4BCB8
                                                                                                                                                                                                                                                                                                                                                                        SHA1:49263695F6B0CDD72F45CF1B775E660FDC36C606
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:https://www.google.com/favicon.ico
                                                                                                                                                                                                                                                                                                                                                                        Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 206

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (557)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):746088
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.792087136477159
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:6144:5HQ91RRdao8gjqXWTY/966mmY6Ed8UCMb:50yM/CMb
                                                                                                                                                                                                                                                                                                                                                                        MD5:0C2A6B46535755464ED7D6572E3CBE0F
                                                                                                                                                                                                                                                                                                                                                                        SHA1:BBDC5F3F6EA2232090BF4953E34B837F4ED21F40
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:818933F581E9EA9B4E7DA5821862857825DF6A4802FF2940A471A4573BA6C46B
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:01028C106D8C927866A46C18B039195D26D106BE11594E1DB769E03B6AD33A8A96F20822B3A50550E33624D2C9C6B2A3E2C7A5714681E0000D3AA4682D2A7579
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEI02kyAjnT2IrWTyM91i1cyCm5BQ/m=_b,_tp"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x1460c1e4, 0x10234c32, 0x39e1fc40, 0x24501e80, 0x1c840, 0x0, 0x34000000, 0x3a000006, 0x31, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.*/./*. SPDX-License-Identifier: Apache-2.0.*/./*. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Na,Ta,gaa,iaa,jb,qaa,waa,Caa,Kaa,Maa,Paa,Jb,Qaa,Ob,Qb,Rb,Raa,Saa,Sb,Taa,Uaa,Vaa,Yb,$aa,bba,ec,hc,ic,gba,hba,lba,nba,pba,qba,uba,xba,rba,wba,vba,tba,sba,yba,Cba,Gba,Hba,Eba,Ic,Jc,Kba,Mba,Qba,Rba,Sba,Tba,Pba,Uba,Wba,dd,Yba,Zba,aca,cca,bca,eca,fca,gca,hca,jca,ica,lca,mca,nca,oc

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 207

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (395)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):1608
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.253999438782652
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:o74cA4t2qdAJl9Ge/a8MxIluosF97Dwbrurw:ohxUl9Z/wDosFmHSw
                                                                                                                                                                                                                                                                                                                                                                        MD5:FF93A29EF55482E16F66237BD08C919F
                                                                                                                                                                                                                                                                                                                                                                        SHA1:F4EC56E968ABF4EC19F581F02D8CA6639DEDAE45
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:2767694FB0407B989B12C17D54E48F490505B3A798DA3943B436546AD0773584
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:17F07EBEE88FE0F0FF175F9D2B67E36273B75736ECC12F2532B4D52BB2B2ABC9B034F104726479BCAC3B4575DC0EADC135926D1211BEF3BA94F9DC48EA47D6F7
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.yg(_.Sla);_.oA=function(a){_.W.call(this,a.Fa);this.aa=a.Xa.cache};_.K(_.oA,_.W);_.oA.Ba=function(){return{Xa:{cache:_.ot}}};_.oA.prototype.execute=function(a){_.Cb(a,function(b){var c;_.cf(b)&&(c=b.fb.kc(b.kb));c&&this.aa.OG(c)},this);return{}};_.wu(_.Yla,_.oA);._.l();._.k("ZDZcre");.var nH=function(a){_.W.call(this,a.Fa);this.ym=a.Ea.ym;this.v4=a.Ea.metadata;this.aa=a.Ea.Dt};_.K(nH,_.W);nH.Ba=function(){return{Ea:{ym:_.SG,metadata:_.n_a,Dt:_.PG}}};nH.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Cb(a,function(c){var d=b.v4.getType(c.Nd())===2?b.ym.Rb(c):b.ym.fetch(c);return _.Rl(c,_.TG)?d.then(function(e){return _.Ed(e)}):d},this)};_.wu(_.cma,nH);._.l();._.k("K5nYTd");._.m_a=new _.uf(_.Zla);._.l();._.k("sP4Vbe");.._.l();._.k("kMFpHd");.._.l();._.k("A7fCU");.var VG=function(a){_.W.call(this,a.Fa);this.aa=a.Ea.FQ};_.K(VG,_.W);VG.Ba=func

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 208

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):52280
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.995413196679271
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
                                                                                                                                                                                                                                                                                                                                                                        MD5:F61F0D4D0F968D5BBA39A84C76277E1A
                                                                                                                                                                                                                                                                                                                                                                        SHA1:AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
                                                                                                                                                                                                                                                                                                                                                                        Preview:wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.*',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.|*(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.5*1w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e*......71.?.7.ORv.?...l...G|.P...|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....|..D.d..

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 209

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (468)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):1970
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.2966551470963585
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:o7ywaGR3cL3A4FUA6E4gsusR7dO/Ufaw/3K/roo8osTCErw:oDMLHFwzDU/mm0HfCAw
                                                                                                                                                                                                                                                                                                                                                                        MD5:A4B059C3E9299DF351F8DCB87B451950
                                                                                                                                                                                                                                                                                                                                                                        SHA1:719E58AE96078AD8D0EB9BD74F346894C10363FF
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:C4158E03E5693AC0059A7C7925133A99440076FE225DECA31D9DEA1EAE84C7DC
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:320885EFBFA877AA96207CE385BD3FB49B04F8B9AAFF65A853F3C5CC1ED83C4720749BE761A8F93D2238AA7F3D3DC9E28BB25ED6E67E64108072C226E762012E
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("iAskyc");._.LZ=function(a){_.W.call(this,a.Fa);this.window=a.Ea.window.get();this.Oc=a.Ea.Oc};_.K(_.LZ,_.W);_.LZ.Ba=function(){return{Ea:{window:_.zu,Oc:_.LE}}};_.LZ.prototype.Yo=function(){};_.LZ.prototype.addEncryptionRecoveryMethod=function(){};_.MZ=function(a){return(a==null?void 0:a.So)||function(){}};_.NZ=function(a){return(a==null?void 0:a.C3)||function(){}};_.yQb=function(a){return(a==null?void 0:a.Wp)||function(){}};._.zQb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.AQb=function(a){setTimeout(function(){throw a;},0)};_.LZ.prototype.uO=function(){return!0};_.OZ=function(a,b,c){a=a.Oc;var d=a.pO,e=new _.AE;b=_.Dj(e,7,_.YVa,b==null?b:_.Oc(b));d.call(a,305,b,c,void 0)};_.wu(_.Ln,_.LZ);._.l();._.k("ziXSP");.var f_=function(a){_.LZ

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 210

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:HTML document, ASCII text, with very long lines (682)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):4069
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.38158802454535
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:96:GSqd6IKpLc2LWvAI3HvtVqEUy4kzsQ5IWdw:6oIKPLWvZHvt7Uy4S4f
                                                                                                                                                                                                                                                                                                                                                                        MD5:EB9A9E3F39936D89B32CA64B4DFD06CD
                                                                                                                                                                                                                                                                                                                                                                        SHA1:E0BD0427B5BEE95F2374EF1C4A1414396BBA8F97
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:0B71496EAE4BBF8E8B13F4E22A4482BEFE6C19AC4D1B24ADC90F33DEE203E945
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:B1F2EFCA5D7256C92010E208BE0E1E0D74F379649800DD934D48E9C02F0295A9C117284070205E55421A33FC79241D11FBA0C917CBA59DF0B9A14EC189F395D8
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.yg(_.lqa);._.k("sOXFj");.var Cu=function(a){_.W.call(this,a.Fa)};_.K(Cu,_.W);Cu.Ba=_.W.Ba;Cu.prototype.aa=function(a){return a()};_.wu(_.kqa,Cu);._.l();._.k("oGtAuc");._.Gya=new _.uf(_.lqa);._.l();._.k("q0xTif");.var Aza=function(a){var b=function(d){_.ho(d)&&(_.ho(d).Jc=null,_.Mu(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},Yu=function(a){_.ut.call(this,a.Fa);this.Qa=this.dom=null;if(this.Bl()){var b=_.Km(this.Wg(),[_.Wm,_.Vm]);b=_.xi([b[_.Wm],b[_.Vm]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.ru(this,b)}this.Ra=a.Cm.Uea};_.K(Yu,_.ut);Yu.Ba=function(){return{Cm:{Uea:function(a){return _.Ye(a)}}}};Yu.prototype.Ip=function(a){return this.Ra.Ip(a)};.Yu.prototype.getData=function(a){return this.Ra.getData(a)};Yu.prototype.Co=function(){_.Ut(this.d

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 211

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (5693)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):699072
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.599345111181688
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:6144:ThYuh7JLIp/M5HiWXvTbGS6eQaUHA9kegy0TKJnc5fiCEcyzhwJWSJvK:TJJ9IpMdXL0kgy0TKV
                                                                                                                                                                                                                                                                                                                                                                        MD5:0A48A257F123BAE3E8AEABC74664F4D2
                                                                                                                                                                                                                                                                                                                                                                        SHA1:4D4E28F9D277A000551203F94DF2F077BC668DBF
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:F0442BA0F3DD0831D98C3323AB3E04DB8418DD895A25DADBDB1F2C4D0E4F0AFE
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:7F5E4750803048161F3E39D6292D8BC3077CD5D05A978A352AA41A6E21A59F62F308C3027BD2C01AEAE6DCF272C3796D6C0FA19A520C9ABF1268F381E5B6A247
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,SpsfSb,aC1iue,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";_F_installCss(".r4WGQb{position:relative}.Dl08I>:first-child{margin-top:0}.Dl08I>:last-child{margin-bottom:0}.IzwVE{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1.25rem;font-weight:400;letter-spacing:0rem;line-height:1.2}.l5PPKe{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-size:1rem}.l5PPKe .dMNVAe{margin:0;padding:0}.l5PPKe>:first-child{margin-top:0;padding-top:0}.l5PPKe>:last-child{margin-bottom:0;padding-bottom:0}.Dl08I{margin:0;padding:0;position:relative}.Dl08I>.SmR8:only-child{padding-top:1px}.Dl08I>.SmR8:only-child::before{top:0}.Dl08I>.SmR8:not(first-child){padding-bottom:1px}.Dl08I>.SmR8::after{bottom:0}.Dl08I>.SmR8:only-child::before,.Dl08I>.SmR8::after{border-bottom:1px solid #c4c7c5;border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5);content:\"\";height:0;left:0;position:absolute;width:100%}.aZvCDf{margin-top:8px;margin-left

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 212

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (754)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):1459
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.249392304721585
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:24:kMYD7DWQuDORqMSsNrmYK0/9gs7hz1x7vDT/wVJOWaeGbZEsGblSFzM8OVLprGJ:o7DYDORIQ9RX6paeGbisGblS+vrw
                                                                                                                                                                                                                                                                                                                                                                        MD5:5B7E4EAF4C0AFDF5404499D594AE353B
                                                                                                                                                                                                                                                                                                                                                                        SHA1:CA4D5D4D43AB6B806374914E0D4638E8193C9619
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:180858AA19EA935EA20E0339FB6CAD3FE20C685905A3C1F3DDD624FEB094E819
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:5A924D708597999B2D7F28D766EEA2C2D5570980F9C1A30600DB921555D25F4236E03CF4D81AD5949656327B568F4F01B6B82ED53C8E2DABD2935C27E8618968
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("lOO0Vd");._.n_a=new _.uf(_.Lm);._.l();._.k("P6sQOc");.var s_a=!!(_.Th[1]&8);var u_a=function(a,b,c,d,e){this.ea=a;this.xa=b;this.ka=c;this.Ca=d;this.Ga=e;this.aa=0;this.da=t_a(this)},v_a=function(a){var b={};_.Ma(a.VS(),function(e){b[e]=!0});var c=a.DS(),d=a.KS();return new u_a(a.zP(),c.aa()*1E3,a.iS(),d.aa()*1E3,b)},t_a=function(a){return Math.random()*Math.min(a.xa*Math.pow(a.ka,a.aa),a.Ca)},WG=function(a,b){return a.aa>=a.ea?!1:b!=null?!!a.Ga[b]:!0};var XG=function(a){_.W.call(this,a.Fa);this.da=a.Ea.WV;this.ea=a.Ea.metadata;a=a.Ea.sha;this.fetch=a.fetch.bind(a)};_.K(XG,_.W);XG.Ba=function(){return{Ea:{WV:_.q_a,metadata:_.n_a,sha:_.g_a}}};XG.prototype.aa=function(a,b){if(this.ea.getType(a.Nd())!==1)return _.dn(a);var c=this.da.rV;return(c=c?v_a(c):null)&&WG(c)?_.Eya(a,w_a(this,a,b,c)):_.dn(a)};.var w_a=function(a,b,c,d){return c.then(function(e){return e},function(e){

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 213

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (533)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):9211
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.401590455839737
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:192:trxq9x5WdZrZJgKQ51Cqs7mPRqezOqFjZ9Jw43y/WdMLli3ALVorOgYx:trY9/Wd1tq8mPIezXnJx3oWdMLlNLVoA
                                                                                                                                                                                                                                                                                                                                                                        MD5:9E63C5CFA6AAC52670130FF40264DF57
                                                                                                                                                                                                                                                                                                                                                                        SHA1:757AFEA21BCD4831D7D4A3E7ED10E8052CEC6AAA
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:9B366409C3F7621BB55118B684FD14235D807921B1D63D905D4D9F56739FA372
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:586C6A196CD7E8114E683F91D4445CE0E101EC63BAE024D21F62C5D9218D7654AC777C8549FA448DBCF6EBB21CEA58D3806D8A1B4EFEF839132A44AD5A578996
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=AvtSve,CMcBD,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,hc6Ubd,inNHtf,lsjVmc,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.ENa=_.z("SD8Jgb",[]);._.EX=function(a,b){if(typeof b==="string")a.Kc(b);else if(b instanceof _.Qp&&b.ia&&b.ia===_.C)b=_.Za(b.Qu()),a.empty().append(b);else if(b instanceof _.Va)b=_.Za(b),a.empty().append(b);else if(b instanceof Node)a.empty().append(b);else throw Error("Xf");};_.FX=function(a){var b=_.To(a,"[jsslot]");if(b.size()>0)return b;b=new _.Ro([_.Yk("span")]);_.Uo(b,"jsslot","");a.empty().append(b);return b};_.NMb=function(a){return a===null||typeof a==="string"&&_.Qi(a)};._.k("SD8Jgb");._.KX=function(a){_.Y.call(this,a.Fa);this.Va=a.controller.Va;this.kd=a.controllers.kd[0]||null;this.header=a.controller.header;this.nav=a.controller.nav;var b;(b=this.ta().find("button:not([type])").el())==null||b.setAttribute("type","button")};_.K(_.KX,_.Y);_.KX.Ba=function(){return{controller:{Va:{jsname:"n7vHCb",ctor:_.vv},header:{jsname:"tJHJj",ctor:_.vv},nav:{jsname:"DH6Rkf",ct

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 214

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1694)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):32500
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.378167466250614
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:768:mDhJ1UQSeQl9Hx+esIvw9f7y4hRloZDAMwXbesyNFD/p5j2jDxgw8w:6IJsIZoRloZDGbgFk1Aw
                                                                                                                                                                                                                                                                                                                                                                        MD5:550CB235515AFEC6AC74D2F7B5D2442B
                                                                                                                                                                                                                                                                                                                                                                        SHA1:C4C38E6BF31956D4795E09D811E75AC5F9B0E5C5
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:31D221611E8005A7259427D01E7B8DBDFC4CBB0C24B567AA1073E24CEEB58FDF
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:F33CF37642792D2549F564F11DD439479A6CA32B7ACE2EB1A0097EF35C3890A098FD8278FB4C230FA8BB756A36820A50EACCF276E335BBCE2117902A4552970E
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{.var Gua=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.op("//www.google.com/images/cleardot.gif");_.zp(c)}this.ka=c};_.h=Gua.prototype;_.h.Yc=null;_.h.FZ=1E4;_.h.rA=!1;_.h.vQ=0;_.h.MJ=null;_.h.oV=null;_.h.setTimeout=function(a){this.FZ=a};_.h.start=function(){if(this.rA)throw Error("dc");this.rA=!0;this.vQ=0;Hua(this)};_.h.stop=function(){Iua(this);this.rA=!1};.var Hua=function(a){a.vQ++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.wm((0,_.eg)(a.hH,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.eg)(a.bka,a),a.aa.onerror=(0,_.eg)(a.aka,a),a.aa.onabort=(0,_.eg)(a.Zja,a),a.MJ=_.wm(a.cka,a.FZ,a),a.aa.src=String(a.ka))};_.h=Gua.prototype;_.h.bka=function(){this.hH(!0)};_.h.aka=function(){this.hH(!1)};_.h.Zja=function(){this.hH(!1)};_.h.cka=function(){this.hH(!1)};._.h.hH=function(a){Iua(this);a?(this.rA=!1,this.da.call(this.ea,!0)):this.vQ<=0?Hua(this):(this.rA=!1,

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 215

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (2907)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):23298
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.4191224553622295
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:384:yD1lVh+Jbv21XYx0LqOnZ8CcG6g88mzdMDr8C/NbpQc9wI:yD1lVh+z8q26CjUzort/NbGAwI
                                                                                                                                                                                                                                                                                                                                                                        MD5:3E81E9F957CE433AF27702329B059853
                                                                                                                                                                                                                                                                                                                                                                        SHA1:D442F984DFA8415FC892343775175D201229587B
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:24AAA7CC46085EC12DB355AB7482B3C6F355F3250900D0EE9C5A70A6969B1E93
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:B6938721EB785228C73BC011D8985FE8644499F12EF24D361B8C7E0E7E7946C526021F726E4192300E997C892B9DDD5C1B5559469407A1940B6CFA8F89783016
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Du.prototype.da=_.ca(40,function(){return _.Cj(this,3)});_.iz=function(a,b){this.key=a;this.defaultValue=!1;this.flagName=b};_.iz.prototype.ctor=function(a){return typeof a==="boolean"?a:this.defaultValue};_.jz=function(){this.ka=!0;var a=_.Gj(_.pk(_.Fe("TSDtV",window),_.Hya),_.Du,1,_.zj())[0];if(a){var b={};for(var c=_.n(_.Gj(a,_.Iya,2,_.zj())),d=c.next();!d.done;d=c.next()){d=d.value;var e=_.Sj(d,1).toString();switch(_.Ej(d,_.Eu)){case 3:b[e]=_.Qj(d,_.uj(d,_.Eu,3));break;case 2:b[e]=_.Sj(d,_.uj(d,_.Eu,2));break;case 4:b[e]=_.Tj(d,_.uj(d,_.Eu,4));break;case 5:b[e]=_.Uj(d,_.uj(d,_.Eu,5));break;case 6:b[e]=_.Yj(d,_.kf,6,_.Eu);break;default:throw Error("kd`"+_.Ej(d,_.Eu));}}}else b={};this.ea=b;this.token=.a?a.da():null};_.jz.prototype.aa=function(a){if(!this.ka||a.key in this.ea)a=a.ctor(this.ea[a.key]);else if(_.Fe("nQyAE",window)){var b=_.Kya(a.flagName);if(b===null)a=a.de

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 216

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):84
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.875266466142591
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ
                                                                                                                                                                                                                                                                                                                                                                        MD5:87B6333E98B7620EA1FF98D1A837A39E
                                                                                                                                                                                                                                                                                                                                                                        SHA1:105DE6815B0885357DE1414BFC0D77FCC9E924EF
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
                                                                                                                                                                                                                                                                                                                                                                        Preview:Cj0KBw0ZARP6GgAKKQ3oIX6GGgQISxgCKhwIClIYCg5AIS4jJF8qLSY/Ky8lLBABGP////8PCgcN05ioBxoA

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 217

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (683)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):3131
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.359967758014897
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:o7PnnaqWVVKIQ5jNQ8jsAA0BAow4ZT+JdD+rAp2KLE1Bv75WgBrz81VJYrw:orX8UF5jOF/864M2KLkR79xOcw
                                                                                                                                                                                                                                                                                                                                                                        MD5:4EB3C32312A283D14E7EFC1B9CD74C0C
                                                                                                                                                                                                                                                                                                                                                                        SHA1:38B45A2BE651DE6E2718C03DCE4C4A957533A60A
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:181A17B2CF11A35C9BBC32813724CFA15D0C46C116C59BB2DB8C543CA185D8A5
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:DAEFD3CDF2A0BA40B3E15AD455E942AEFE6F0749C0DBAE2BB2FDADEC58AB24F415067D66EE28EE106DE786546AC0F1A892FB2F1507C6BD9862FA63A0C78E40B7
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var qA=function(a){_.W.call(this,a.Fa)};_.K(qA,_.W);qA.Ba=_.W.Ba;qA.prototype.qS=function(a){return _.af(this,{Xa:{sT:_.wl}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.vi(function(e){window._wjdc=function(f){d(f);e(iKa(f,b,a))}}):iKa(c,b,a)})};var iKa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.sT.qS(c)};.qA.prototype.aa=function(a,b){var c=_.Nra(b).Wj;if(c.startsWith("$")){var d=_.sm.get(a);_.Dq[b]&&(d||(d={},_.sm.set(a,d)),d[c]=_.Dq[b],delete _.Dq[b],_.Eq--);if(d)if(a=d[c])b=_.df(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.wu(_.Rfa,qA);._.l();._.k("SNUn3");._.hKa=new _.uf(_.zg);._.l();._.k("RMhBfe");.var jKa=function(a){var b=_.Cq(a);return b?new _.vi(function(c,d){var e=function(){b=_.Cq(a);var f=_.Yfa(a,b);f?c(f.getAttribute("jsdata")):window.document.readyState=="complete"?(f=["Unable to find deferred jsdata wit

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 218

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (522)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):5050
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.308347802561222
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:96:oo5mEkAVSoYSvSgNBTeLZBagj9PIauzLmybxf8Vh15b6r/Nm2TmpI6qLw:N4lAFDLxAPSVaGZ+yc
                                                                                                                                                                                                                                                                                                                                                                        MD5:6A2A5DC595FA915688C2C15E9064AA76
                                                                                                                                                                                                                                                                                                                                                                        SHA1:487184814F226A80611F104C57D106039CD6E1D3
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:24744179DFE1C2C520A76978B7071234322C995EAE18BB0050DFB490BCB51B2C
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:70ED0557426BB994F5D4BD849AC47C1D73726443A7D8B126D66186857A0216F19134EF77CF0116D57DA524A9E22703D2CC3173AA6D3E243BD45A387EAAC8B475
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,iAskyc,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.xNa=_.z("wg1P6b",[_.cB,_.Nn,_.Vn]);._.k("wg1P6b");.var q6a;q6a=_.uh(["aria-"]);._.BJ=function(a){_.Y.call(this,a.Fa);this.Ka=this.xa=this.aa=this.viewportElement=this.Na=null;this.Ic=a.Ea.ef;this.ab=a.Ea.focus;this.Ec=a.Ea.Ec;this.ea=this.Vi();a=-1*parseInt(_.No(this.Vi().el(),"marginTop")||"0",10);var b=parseInt(_.No(this.Vi().el(),"marginBottom")||"0",10);this.Ta={top:a,right:0,bottom:b,left:0};a=_.ff(this.getData("isMenuDynamic"),!1);b=_.ff(this.getData("isMenuHoisted"),!1);this.Ga=a?1:b?2:0;this.ka=!1;this.Ca=1;this.Ga!==1&&(this.aa=this.Sa("U0exHf").children().Vc(0),_.ru(this,.r6a(this,this.aa.el())));_.sF(this.ta())&&(a=this.ta().el(),b=this.we.bind(this),a.__soy_skip_handler=b)};_.K(_.BJ,_.Y);_.BJ.Ba=function(){return{Ea:{ef:_.gF,focus:_.SE,Ec:_.Au}}};_.BJ.prototype.JF=function(a){var b=a.source;this.Na=b;var c;((c=a.data)==null?0:c.Dz)?(a=a.data.Dz,this.Ca=a==="MOUS

                                                                                                                                                                                                                                                                                                                                                                        Chrome Cache Entry: 219

                                                                                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (570)
                                                                                                                                                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                                                                                                                                                        Size (bytes):3467
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.479603237367378
                                                                                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:48:o7YAIx00suAuYbdjTQ929Y4WfQ4pksFhP606Lvz7Xjv7I5B7+zVag91P7gFMwrw:o0AIx00sXFh/q29oftpvv/UDLLoMEw
                                                                                                                                                                                                                                                                                                                                                                        MD5:9D1BCDC903DD5EB217C2D67ACD6DB47C
                                                                                                                                                                                                                                                                                                                                                                        SHA1:A16BE44C9DA1C922650DE782AB76F55BD0D692BB
                                                                                                                                                                                                                                                                                                                                                                        SHA-256:49B1FAB2085EA92365AE2B567A60399CC9A037E0A5A8B3418DC820F1F73587D8
                                                                                                                                                                                                                                                                                                                                                                        SHA-512:E527A53F972568DF44E0AF0E28B53A0F04D435CCD7EB108B89098887BAA475679FD7AA43E995D7B37719E510C40E838B2AF09C9EA89AAEEB6F054CFF25EE4DD9
                                                                                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.KYvE2Q9CLYc.es5.O/ck=boq-identity.AccountsSignInUi.O1EYjscQ2Gc.L.B1.O/am=5MFglAzTCATEH54DekCRQMgBAAAAAAAAAEAbAADoMQ/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,iAskyc,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH4V5UC0g8TPMbdoHGxjnXBXxDbBw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                                                                                                                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var jya=function(){var a=_.Ke();return _.Uj(a,1)},hu=function(a){this.Da=_.u(a,0,hu.messageId)};_.K(hu,_.w);hu.prototype.Ha=function(){return _.Mj(this,1)};hu.prototype.Ua=function(a){return _.ek(this,1,a)};hu.messageId="f.bo";var iu=function(){_.tm.call(this)};_.K(iu,_.tm);iu.prototype.yd=function(){this.XT=!1;kya(this);_.tm.prototype.yd.call(this)};iu.prototype.aa=function(){lya(this);if(this.RC)return mya(this),!1;if(!this.eW)return ju(this),!0;this.dispatchEvent("p");if(!this.OP)return ju(this),!0;this.RM?(this.dispatchEvent("r"),ju(this)):mya(this);return!1};.var nya=function(a){var b=new _.op(a.n5);a.yQ!=null&&_.Un(b,"authuser",a.yQ);return b},mya=function(a){a.RC=!0;var b=nya(a),c="rt=r&f_uid="+_.zk(a.OP);_.on(b,(0,_.eg)(a.ea,a),"POST",c)};.iu.prototype.ea=function(a){a=a.target;lya(this);if(_.rn(a)){this.lK=0;if(this.RM)this.RC=!1,this.dispatchEvent("r"

                                                                                                                                                                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.583350180285038
                                                                                                                                                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                                                                                                                                        File name:file.exe
                                                                                                                                                                                                                                                                                                                                                                        File size:919'040 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5:008d4c1cdb9b763e867f32ce0e5219be
                                                                                                                                                                                                                                                                                                                                                                        SHA1:d8265514c93b7a41fbf9e9ef89df3964b2dab522
                                                                                                                                                                                                                                                                                                                                                                        SHA256:2d6e0324011f23f51b7f221e2bcb7562292cb71d2f65228f004059f857bff4f1
                                                                                                                                                                                                                                                                                                                                                                        SHA512:a203ea34c5dcb939ccfcd4aefd1502cdc9211be9810c26f29f52cabfb96968dbcb671a5e421adb422d04589c8beeb5d923b8034624bfbf375bd2fe5035659117
                                                                                                                                                                                                                                                                                                                                                                        SSDEEP:12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTY:fqDEvCTbMWu7rQYlBQcBiT6rprG8avY
                                                                                                                                                                                                                                                                                                                                                                        TLSH:09159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
                                                                                                                                                                                                                                                                                                                                                                        File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                                                                                                                                                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                                                                                                                                                                        Icon Hash:aaf3e3e3938382a0

                                                                                                                                                                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Entrypoint:0x420577
                                                                                                                                                                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                                                                                                                                                                                                                                                        DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                                                                                                                                        Time Stamp:0x6705AB47 [Tue Oct 8 21:59:35 2024 UTC]
                                                                                                                                                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                                                                                                                                                        OS Version Major:5
                                                                                                                                                                                                                                                                                                                                                                        OS Version Minor:1
                                                                                                                                                                                                                                                                                                                                                                        File Version Major:5
                                                                                                                                                                                                                                                                                                                                                                        File Version Minor:1
                                                                                                                                                                                                                                                                                                                                                                        Subsystem Version Major:5
                                                                                                                                                                                                                                                                                                                                                                        Subsystem Version Minor:1
                                                                                                                                                                                                                                                                                                                                                                        Import Hash:948cc502fe9226992dce9417f952fce3

                                                                                                                                                                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                                                                                                                                                        call 00007F98546068A3h
                                                                                                                                                                                                                                                                                                                                                                        jmp 00007F98546061AFh
                                                                                                                                                                                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                                                                                                                        push dword ptr [ebp+08h]
                                                                                                                                                                                                                                                                                                                                                                        mov esi, ecx
                                                                                                                                                                                                                                                                                                                                                                        call 00007F985460638Dh
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [esi], 0049FDF0h
                                                                                                                                                                                                                                                                                                                                                                        mov eax, esi
                                                                                                                                                                                                                                                                                                                                                                        pop esi
                                                                                                                                                                                                                                                                                                                                                                        pop ebp
                                                                                                                                                                                                                                                                                                                                                                        retn 0004h
                                                                                                                                                                                                                                                                                                                                                                        and dword ptr [ecx+04h], 00000000h
                                                                                                                                                                                                                                                                                                                                                                        mov eax, ecx
                                                                                                                                                                                                                                                                                                                                                                        and dword ptr [ecx+08h], 00000000h
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [ecx+04h], 0049FDF8h
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [ecx], 0049FDF0h
                                                                                                                                                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                                                                                                                        push dword ptr [ebp+08h]
                                                                                                                                                                                                                                                                                                                                                                        mov esi, ecx
                                                                                                                                                                                                                                                                                                                                                                        call 00007F985460635Ah
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [esi], 0049FE0Ch
                                                                                                                                                                                                                                                                                                                                                                        mov eax, esi
                                                                                                                                                                                                                                                                                                                                                                        pop esi
                                                                                                                                                                                                                                                                                                                                                                        pop ebp
                                                                                                                                                                                                                                                                                                                                                                        retn 0004h
                                                                                                                                                                                                                                                                                                                                                                        and dword ptr [ecx+04h], 00000000h
                                                                                                                                                                                                                                                                                                                                                                        mov eax, ecx
                                                                                                                                                                                                                                                                                                                                                                        and dword ptr [ecx+08h], 00000000h
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [ecx+04h], 0049FE14h
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [ecx], 0049FE0Ch
                                                                                                                                                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                                                                                                                        mov esi, ecx
                                                                                                                                                                                                                                                                                                                                                                        lea eax, dword ptr [esi+04h]
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [esi], 0049FDD0h
                                                                                                                                                                                                                                                                                                                                                                        and dword ptr [eax], 00000000h
                                                                                                                                                                                                                                                                                                                                                                        and dword ptr [eax+04h], 00000000h
                                                                                                                                                                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                                                                                                                                                                        mov eax, dword ptr [ebp+08h]
                                                                                                                                                                                                                                                                                                                                                                        add eax, 04h
                                                                                                                                                                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                                                                                                                                                                        call 00007F9854608F4Dh
                                                                                                                                                                                                                                                                                                                                                                        pop ecx
                                                                                                                                                                                                                                                                                                                                                                        pop ecx
                                                                                                                                                                                                                                                                                                                                                                        mov eax, esi
                                                                                                                                                                                                                                                                                                                                                                        pop esi
                                                                                                                                                                                                                                                                                                                                                                        pop ebp
                                                                                                                                                                                                                                                                                                                                                                        retn 0004h
                                                                                                                                                                                                                                                                                                                                                                        lea eax, dword ptr [ecx+04h]
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [ecx], 0049FDD0h
                                                                                                                                                                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                                                                                                                                                                        call 00007F9854608F98h
                                                                                                                                                                                                                                                                                                                                                                        pop ecx
                                                                                                                                                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                                                                                                                        mov esi, ecx
                                                                                                                                                                                                                                                                                                                                                                        lea eax, dword ptr [esi+04h]
                                                                                                                                                                                                                                                                                                                                                                        mov dword ptr [esi], 0049FDD0h
                                                                                                                                                                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                                                                                                                                                                        call 00007F9854608F81h
                                                                                                                                                                                                                                                                                                                                                                        test byte ptr [ebp+08h], 00000001h
                                                                                                                                                                                                                                                                                                                                                                        pop ecx

                                                                                                                                                                                                                                                                                                                                                                        Rich Headers

                                                                                                                                                                                                                                                                                                                                                                        Programming Language:
                                                                                                                                                                                                                                                                                                                                                                        • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                                                                                                                                                                                                                        • [IMP] VS2008 SP1 build 30729

                                                                                                                                                                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000x9a08.rsrc
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xde0000x7594.reloc
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                                                                                                                                        .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                                                                                        .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                                                                                        .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                                                                                                                        .rsrc0xd40000x9a080x9c009b216437ff939d167a2ddc7591cd57fdFalse0.3053135016025641data5.327376071001933IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                                                                                        .reloc0xde0000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xd8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                                                                                                                                                                                                                                                                                                                        RT_ICON0xda0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                                                                                                                                                                                                                                                                                                                        RT_MENU0xda4a00x50dataEnglishGreat Britain0.9
                                                                                                                                                                                                                                                                                                                                                                        RT_STRING0xda4f00x594dataEnglishGreat Britain0.3333333333333333
                                                                                                                                                                                                                                                                                                                                                                        RT_STRING0xdaa840x68adataEnglishGreat Britain0.2735961768219833
                                                                                                                                                                                                                                                                                                                                                                        RT_STRING0xdb1100x490dataEnglishGreat Britain0.3715753424657534
                                                                                                                                                                                                                                                                                                                                                                        RT_STRING0xdb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                                                                                                                                                                                                                                                                                        RT_STRING0xdbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                                                                                                                                                                                                                                                                                        RT_STRING0xdc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                                                                                                                                                                                                                                                                                                                                        RT_STRING0xdc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                                                                                                                                                                                                                                                                                                                        RT_RCDATA0xdc7b80xccedata1.0033557046979866
                                                                                                                                                                                                                                                                                                                                                                        RT_GROUP_ICON0xdd4880x76dataEnglishGreat Britain0.6610169491525424
                                                                                                                                                                                                                                                                                                                                                                        RT_GROUP_ICON0xdd5000x14dataEnglishGreat Britain1.25
                                                                                                                                                                                                                                                                                                                                                                        RT_GROUP_ICON0xdd5140x14dataEnglishGreat Britain1.15
                                                                                                                                                                                                                                                                                                                                                                        RT_GROUP_ICON0xdd5280x14dataEnglishGreat Britain1.25
                                                                                                                                                                                                                                                                                                                                                                        RT_VERSION0xdd53c0xdcdataEnglishGreat Britain0.6181818181818182
                                                                                                                                                                                                                                                                                                                                                                        RT_MANIFEST0xdd6180x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                                                                                                                                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                                                                                                                                                        WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                                                                                                                                                                                                                                                                                                                                        VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                                                                                                                                                                                                                                                                                                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                                                                                                                                                                                                                                                                                        COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                                                                                                                                                                                                                                                                                                                                        MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                                                                                                                                                                                                                                                                                                                                        WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                                                                                                                                                                                                                                                                                                                                        PSAPI.DLLGetProcessMemoryInfo
                                                                                                                                                                                                                                                                                                                                                                        IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                                                                                                                                                                                                                                                                                                                                        USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                                                                                                                                                                                                                                                                                                                                        UxTheme.dllIsThemeActive
                                                                                                                                                                                                                                                                                                                                                                        KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                                                                                                                                                                                                                                                                                                                                                                        USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                                                                                                                                                                                                                                                                                                                                                                        GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                                                                                                                                                                                                                                                                                                                                                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                                                                                                                                                                                                                                                                                        ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                                                                                                                                                                                                                                                                                                                                                                        SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                                                                                                                                                                                                                                                                                                                                        ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                                                                                                                                                                                                                                                                                                                                        OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                                                                                                                                                                                                                                                                                                                                                                        Possible Origin

                                                                                                                                                                                                                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                                                                                                                                        EnglishGreat Britain

                                                                                                                                                                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:03:54.999038935 CEST49675443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:03:54.999090910 CEST49674443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:03:55.155374050 CEST49673443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:04.608201027 CEST49674443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:04.608298063 CEST49675443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:04.764451981 CEST49673443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.615942001 CEST4434970323.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.616301060 CEST49703443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.648341894 CEST49710443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.648439884 CEST4434971035.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.648853064 CEST49710443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.654727936 CEST49710443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.654813051 CEST4434971035.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.128807068 CEST4434971035.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.136471033 CEST49710443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.193737030 CEST49710443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.193809986 CEST4434971035.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.194299936 CEST4434971035.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.197611094 CEST49710443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.197630882 CEST4434971035.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.399480104 CEST4434971035.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:07.402343988 CEST49710443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.748967886 CEST49712443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.749073029 CEST44349712142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.751130104 CEST49712443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.756534100 CEST49712443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.756623030 CEST44349712142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.757509947 CEST49713443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.757611990 CEST44349713142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.764549017 CEST4971480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.769687891 CEST804971434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.770242929 CEST4971480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.770248890 CEST49713443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.787974119 CEST49713443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.788049936 CEST44349713142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.788166046 CEST4971480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.793751955 CEST804971434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.260673046 CEST804971434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.375157118 CEST4971480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.399468899 CEST44349712142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.399672031 CEST49712443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.400468111 CEST44349712142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.400717020 CEST49712443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.405626059 CEST49712443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.405679941 CEST44349712142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.405745029 CEST49712443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.406016111 CEST44349712142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.406198025 CEST49712443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.501241922 CEST49715443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.501348019 CEST4434971534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.506833076 CEST49715443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.508574963 CEST49715443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.508655071 CEST4434971534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.521181107 CEST44349713142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.521219015 CEST44349713142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.522330999 CEST49713443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.522623062 CEST44349713142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.530514956 CEST49713443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.534292936 CEST49713443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.534339905 CEST44349713142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.534540892 CEST49713443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.534867048 CEST44349713142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.534992933 CEST49716443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.535083055 CEST44349716142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.535106897 CEST49713443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.536189079 CEST49716443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.538367987 CEST49716443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.538450956 CEST44349716142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.673414946 CEST4971780192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.678797007 CEST804971734.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.696289062 CEST4971780192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.697254896 CEST4971780192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.702121019 CEST804971734.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.733268023 CEST49718443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.733345032 CEST4434971835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.737040997 CEST49718443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.737082958 CEST49718443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.737091064 CEST4434971835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.985385895 CEST4434971534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.990796089 CEST49715443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.992566109 CEST49715443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.992610931 CEST4434971534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.992746115 CEST49715443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.992888927 CEST4434971534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.993293047 CEST49719443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.993388891 CEST4434971934.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.998306990 CEST49715443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.998306990 CEST49719443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.000900030 CEST49719443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.000936031 CEST4434971934.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.159832954 CEST804971734.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.168049097 CEST49720443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.168138027 CEST4434972034.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.178138971 CEST49720443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.186353922 CEST44349716142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.188882113 CEST44349716142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.199412107 CEST44349716142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.200336933 CEST49716443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.201420069 CEST49716443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.204945087 CEST49720443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.205032110 CEST4434972034.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.211080074 CEST49716443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.211139917 CEST44349716142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.211193085 CEST49716443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.211766958 CEST44349716142.250.181.238192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.223293066 CEST49716443192.168.2.5142.250.181.238
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.223577976 CEST4434971835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.226762056 CEST49718443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.230693102 CEST49718443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.230707884 CEST4434971835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.231406927 CEST4434971835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.233973026 CEST49718443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.234133959 CEST49718443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.234162092 CEST49718443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.284338951 CEST4971780192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.479317904 CEST4434971934.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.486977100 CEST49719443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.698848963 CEST4434972034.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.698868990 CEST4434972034.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.708532095 CEST49720443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.980688095 CEST49719443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.980772018 CEST4434971934.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.980923891 CEST49719443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.981208086 CEST4434971934.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.982213020 CEST49719443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.985172033 CEST49720443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.985200882 CEST4434972034.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.985371113 CEST49720443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.985536098 CEST4434972034.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.988173008 CEST49720443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.228667974 CEST49721443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.228766918 CEST4434972134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.230048895 CEST49721443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.232913017 CEST49721443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.232952118 CEST4434972134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.244816065 CEST4971780192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.245044947 CEST4971480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.251209021 CEST804971734.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.251254082 CEST804971434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.259011984 CEST4971780192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.259032011 CEST4971480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.466969013 CEST49722443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.467012882 CEST4434972234.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.468072891 CEST49722443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.468164921 CEST49722443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.468184948 CEST4434972234.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.490644932 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.490664959 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.492280960 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.492666006 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.492697954 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.516961098 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.517045021 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.519352913 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.521536112 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.521564007 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.733549118 CEST4434972134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.734157085 CEST49721443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.949309111 CEST4434972234.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.950524092 CEST49722443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.144117117 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.144644022 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.144665003 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.145221949 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.146101952 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.146212101 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.146303892 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.148509026 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.148595095 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.149250984 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.169789076 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.170084000 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.174596071 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.174621105 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.175030947 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.195436954 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.215702057 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.259422064 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.300508022 CEST49722443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.300586939 CEST4434972234.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.301459074 CEST4434972234.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.312339067 CEST49721443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.312340021 CEST49721443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.312388897 CEST4434972134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.312709093 CEST49722443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.312710047 CEST49722443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.312886953 CEST4434972134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.313066006 CEST49721443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.313234091 CEST4434972234.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.313920975 CEST49722443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.355482101 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.356751919 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.395446062 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.400600910 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.406869888 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.406980038 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.412106037 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.437314034 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.437472105 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.439507961 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.440229893 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.455111980 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.455192089 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.467344999 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.467381954 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.467431068 CEST49727443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.467447996 CEST44349727184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.517951965 CEST49724443192.168.2.5142.250.184.206
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.518007994 CEST44349724142.250.184.206192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.579957962 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.580039024 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.580517054 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.580965042 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.581002951 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.616255999 CEST49731443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.616342068 CEST4434973134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.620168924 CEST49731443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.621956110 CEST49731443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.621994019 CEST4434973134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.882719994 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.017851114 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.102020979 CEST4434973134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.102535963 CEST49731443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.108933926 CEST49731443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.108966112 CEST4434973134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.109034061 CEST49731443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.109256029 CEST4434973134.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.118128061 CEST49731443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.228457928 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.228823900 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.230727911 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.230782986 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.231503010 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.233083010 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.275446892 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.496857882 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.497013092 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.507421970 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.517282009 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.588092089 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.588092089 CEST49730443192.168.2.5184.28.90.27
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.588136911 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.588159084 CEST44349730184.28.90.27192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.957178116 CEST49733443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.957220078 CEST4434973334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.957700014 CEST49733443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.959794998 CEST49733443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:13.959810972 CEST4434973334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.032533884 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.037797928 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.037914991 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.038033962 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.043014050 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.452457905 CEST4434973334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.452558041 CEST49733443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.458648920 CEST49733443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.458662987 CEST4434973334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.458852053 CEST49733443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.459028959 CEST4434973334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.459104061 CEST49733443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.505558014 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.684094906 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.940905094 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.940968990 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.941113949 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.941318989 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.941339016 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.269634962 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.269687891 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.270306110 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.272001982 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.272023916 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.597558022 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.604079008 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.604125023 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.605649948 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.605730057 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.608489037 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.608592987 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.683077097 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.683095932 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.783176899 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.079811096 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.085308075 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.089519024 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.089534044 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.089976072 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.174397945 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.264566898 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.264633894 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.264787912 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.265080929 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.265100956 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.414149046 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.418976068 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.510313988 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.706195116 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.817337036 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.863436937 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.947458029 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.947532892 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.948965073 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.948995113 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.949492931 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.960741997 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.003420115 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.077810049 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.077855110 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.077996969 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.078069925 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.078135967 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.078212976 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.078248024 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.079730988 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.079756975 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.079765081 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.079818010 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.079847097 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.079864979 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080060005 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080080032 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080147028 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080369949 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080379009 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080434084 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080446005 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080466032 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.080524921 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.153544903 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.153594971 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.153769970 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.153832912 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.155766010 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.164918900 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.164988041 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.165014029 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.165030003 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.165066004 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.165174007 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.239707947 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.239732981 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.240823984 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.242598057 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.242679119 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.242727995 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.242799044 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.243525982 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.243544102 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.243576050 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.251836061 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.251912117 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.252352953 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.252371073 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.252403021 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.301696062 CEST49703443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.301799059 CEST49703443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.302292109 CEST49750443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.302335978 CEST4434975023.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.302402973 CEST49750443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.302772999 CEST49750443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.302789927 CEST4434975023.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.306533098 CEST4434970323.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.306587934 CEST4434970323.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.307001114 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.326278925 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.326351881 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.326411963 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.327223063 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.327275038 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.328191042 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.328237057 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.329163074 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.329211950 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337697983 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337779045 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337851048 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337851048 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337882042 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337899923 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337941885 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337953091 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.337979078 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.338042021 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.338095903 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.338181019 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.338196993 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.338223934 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.338404894 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.338577032 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.339085102 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.339085102 CEST49742443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.339112043 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.339134932 CEST4434974213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.408480883 CEST49751443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.408534050 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.410260916 CEST49752443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.410324097 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.413089037 CEST49753443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.413139105 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.413588047 CEST49752443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.413589954 CEST49751443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.413896084 CEST49753443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.414369106 CEST49751443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.414402962 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.414575100 CEST49752443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.414608002 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.414727926 CEST49754443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.414737940 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.414906025 CEST49753443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.414916992 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.415277958 CEST49755443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.415298939 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.418297052 CEST49754443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.418407917 CEST49755443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.418853998 CEST49754443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.418863058 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.418903112 CEST49755443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.418924093 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.577929020 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.578000069 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.578033924 CEST49738443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.578052044 CEST443497384.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.898291111 CEST4434975023.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:17.898375034 CEST49750443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.062031031 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.062096119 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.062562943 CEST49752443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.062622070 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.064244986 CEST49752443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.064260006 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.066039085 CEST49751443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.066095114 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.066437006 CEST49751443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.066452026 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.067645073 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.068059921 CEST49754443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.068078041 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.068445921 CEST49754443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.068449974 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.071696043 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.072494030 CEST49753443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.072506905 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.072921991 CEST49753443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.072926044 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.101618052 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.101996899 CEST49755443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.102016926 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.102380991 CEST49755443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.102391958 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.163957119 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.164017916 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.164144039 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.168972969 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.169029951 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.169210911 CEST49751443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.169235945 CEST49754443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.171838999 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.171890974 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.172477961 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.172669888 CEST49753443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.174212933 CEST49751443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.174212933 CEST49751443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.174247026 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.174271107 CEST4434975113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.175615072 CEST49754443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.175631046 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.175641060 CEST49754443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.175646067 CEST4434975413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.176568985 CEST49753443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.176573038 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.176605940 CEST49753443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.176609039 CEST4434975313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.185127020 CEST49760443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.185149908 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.186598063 CEST49761443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.186619043 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.186961889 CEST49760443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.187098980 CEST49761443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.190334082 CEST49760443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.190356970 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.190413952 CEST49761443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.190438032 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.191140890 CEST49763443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.191159964 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.191236973 CEST49763443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.191329002 CEST49763443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.191342115 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.203871012 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.204009056 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.205010891 CEST49752443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.205734968 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.205790997 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.205950022 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.208134890 CEST49755443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.208769083 CEST49752443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.208770037 CEST49752443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.208838940 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.208874941 CEST4434975213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.209701061 CEST49755443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.209701061 CEST49755443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.209717989 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.209741116 CEST4434975513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.257771969 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.257857084 CEST4434976413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.257963896 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.258871078 CEST49765443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.258908987 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.266304016 CEST49765443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.272430897 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.272516012 CEST4434976413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.273988008 CEST49765443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.274008989 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.841911077 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.842597008 CEST49763443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.842628002 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.844197035 CEST49763443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.844208002 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.848352909 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.848716021 CEST49760443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.848731041 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.849107981 CEST49760443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.849118948 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.887528896 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.888015032 CEST49761443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.888032913 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.888462067 CEST49761443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.888469934 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.913430929 CEST4434976413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.913829088 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.913908958 CEST4434976413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.914216995 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.914231062 CEST4434976413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.942423105 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.942584991 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.942805052 CEST49763443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.943161011 CEST49763443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.943186998 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.943231106 CEST49763443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.943245888 CEST4434976313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.946310043 CEST49766443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.946346998 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.946613073 CEST49766443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.947149992 CEST49766443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.947161913 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.950071096 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.950222969 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.953489065 CEST49760443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.953733921 CEST49760443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.953733921 CEST49760443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.953753948 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.953789949 CEST4434976013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.954138041 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.954786062 CEST49765443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.954793930 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.956391096 CEST49765443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.956396103 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.957779884 CEST49767443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.957881927 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.958117962 CEST49767443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.958257914 CEST49767443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.958282948 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.026926994 CEST4434976413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.027060986 CEST4434976413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.027268887 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.027268887 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.027268887 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.029669046 CEST49768443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.029733896 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.038743019 CEST49768443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039006948 CEST49768443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039040089 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039525032 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039592981 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039660931 CEST49761443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039791107 CEST49761443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039791107 CEST49761443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039824963 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.039848089 CEST4434976113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.047926903 CEST49769443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.048013926 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.048275948 CEST49769443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.048387051 CEST49769443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.048418999 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.059039116 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.059185028 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.059252977 CEST49765443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.059273958 CEST49765443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.059287071 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.059294939 CEST49765443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.059298992 CEST4434976513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.061407089 CEST49770443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.061491966 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.061598063 CEST49770443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.061681986 CEST49770443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.061708927 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.409883022 CEST49764443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.409933090 CEST4434976413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.595756054 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.596236944 CEST49766443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.596251965 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.596709013 CEST49766443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.596714020 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.625767946 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.626425982 CEST49767443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.626486063 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.626868963 CEST49767443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.626883984 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.676768064 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.677467108 CEST49768443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.677498102 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.677906990 CEST49768443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.677918911 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.690608025 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.692728043 CEST49769443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.692790031 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.693281889 CEST49769443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.693296909 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.698026896 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.698103905 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.698163033 CEST49766443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.698287010 CEST49766443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.698302984 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.698313951 CEST49766443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.698318958 CEST4434976613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.701325893 CEST49771443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.701379061 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.701468945 CEST49771443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.701684952 CEST49771443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.701710939 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.930054903 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.930135012 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.930196047 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.930243015 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.930404902 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.930531025 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931068897 CEST49768443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931072950 CEST49769443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931072950 CEST49767443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931349993 CEST49768443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931349993 CEST49768443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931351900 CEST49767443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931353092 CEST49767443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931399107 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931411028 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931423903 CEST4434976813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.931438923 CEST4434976713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.932085991 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.932176113 CEST49769443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.932176113 CEST49769443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.932210922 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.932233095 CEST4434976913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.934376001 CEST49770443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.934393883 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.934817076 CEST49770443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.934828043 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.936120987 CEST49772443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.936147928 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.938240051 CEST49773443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.938271046 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.939305067 CEST49774443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.939317942 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.943573952 CEST49772443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.943671942 CEST49773443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.943927050 CEST49772443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.943969965 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.943989992 CEST49774443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.944176912 CEST49773443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.944194078 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.947134972 CEST49774443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:19.947146893 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.040391922 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.040476084 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.040707111 CEST49770443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.040746927 CEST49770443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.040746927 CEST49770443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.040766954 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.040790081 CEST4434977013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.043931961 CEST49781443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.044017076 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.044130087 CEST49781443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.044301987 CEST49781443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.044337034 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.594645023 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.595300913 CEST49771443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.595345020 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.595763922 CEST49771443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.595776081 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.598628998 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.598990917 CEST49772443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.599039078 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.599358082 CEST49772443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.599370003 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.600569963 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.600892067 CEST49773443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.600905895 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.601217985 CEST49773443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.601234913 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.619683981 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.620527029 CEST49774443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.620534897 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.621198893 CEST49774443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.621205091 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.691128016 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.696784019 CEST49781443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.696813107 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.697227001 CEST49781443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.697232962 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.698453903 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.698506117 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.698663950 CEST49771443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.698906898 CEST49771443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.698906898 CEST49771443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.698945999 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.698968887 CEST4434977113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.700052977 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.700191021 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.700428009 CEST49772443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.700694084 CEST49772443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.700694084 CEST49772443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.700731993 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.700757027 CEST4434977213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.701391935 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.701523066 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.702919006 CEST49782443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.702934980 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.702971935 CEST49783443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703011990 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703058958 CEST49782443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703079939 CEST49773443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703171968 CEST49773443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703171968 CEST49773443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703186989 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703197956 CEST4434977313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703269958 CEST49782443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703274965 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.703306913 CEST49783443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.705096960 CEST49784443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.705118895 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.705136061 CEST49783443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.705152035 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.709541082 CEST49784443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.709541082 CEST49784443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.709569931 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.726138115 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.726281881 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.726567984 CEST49774443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.726901054 CEST49774443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.726901054 CEST49774443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.726907969 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.726917982 CEST4434977413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.732749939 CEST49785443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.732815027 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.733051062 CEST49785443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.733364105 CEST49785443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.733393908 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.832863092 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.832950115 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.834393978 CEST49781443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.850681067 CEST49781443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.850693941 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.850704908 CEST49781443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.850708961 CEST4434978113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.853676081 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.853734016 CEST4434978613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.858088970 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.870455027 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:20.870484114 CEST4434978613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.135948896 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.135999918 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.140336037 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.148452044 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.148467064 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.353949070 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.354579926 CEST49783443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.354619026 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.355017900 CEST49783443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.355024099 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.367717981 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.368520021 CEST49784443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.368541956 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.369018078 CEST49784443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.369025946 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.379631042 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.381108999 CEST49785443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.381154060 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.381437063 CEST49785443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.381443977 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.391117096 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.392579079 CEST49782443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.392607927 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.392910004 CEST49782443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.392916918 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.453785896 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.453840971 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.454756021 CEST49783443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.454782009 CEST49783443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.454803944 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.454817057 CEST49783443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.454827070 CEST4434978313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.456933022 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.456998110 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.457077980 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.457231998 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.457262039 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.467176914 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.467317104 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.472943068 CEST49784443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.473145008 CEST49784443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.473174095 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.473187923 CEST49784443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.473196030 CEST4434978413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.475414038 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.475439072 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.475512981 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.475630999 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.475652933 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.479288101 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.479518890 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.479592085 CEST49785443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.479650974 CEST49785443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.479650974 CEST49785443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.479685068 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.479707003 CEST4434978513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.482172012 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.482270002 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.482585907 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.482724905 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.482763052 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.494683027 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.494826078 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.495377064 CEST49782443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.495522976 CEST49782443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.495538950 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.495570898 CEST49782443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.495579004 CEST4434978213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.498358965 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.498383045 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.498646975 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.498778105 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.498794079 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.509073973 CEST4434978613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.509856939 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.509876013 CEST4434978613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.510220051 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.510230064 CEST4434978613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.607157946 CEST4434978613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.607319117 CEST4434978613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.607445002 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.607445002 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.607445002 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.609117985 CEST49794443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.609136105 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.609287024 CEST49794443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.609433889 CEST49794443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.609446049 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.701555967 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.706810951 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.785588026 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.785962105 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.786030054 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.787380934 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.787492990 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.789933920 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.790189028 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.791183949 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.791268110 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.791296959 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.791491985 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.800539970 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.839567900 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.839627981 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.854733944 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.885165930 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.918761969 CEST49786443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.918828964 CEST4434978613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.104249001 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.104376078 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.104459047 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.106410027 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.106455088 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.107805967 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.109890938 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.116416931 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.116504908 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.121418953 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.121438026 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.121968031 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.122536898 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.124660015 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.124674082 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.127324104 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.129977942 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.130034924 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.139650106 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.139664888 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.145693064 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.149935007 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.152893066 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.168363094 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.168474913 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.170047998 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.170103073 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.184545994 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.190697908 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.190785885 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.192692995 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.192708969 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.193424940 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.193558931 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.193603039 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.199640989 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.199728966 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.205986023 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.208292961 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.208312035 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.208313942 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.208321095 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.212177992 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.213002920 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.213020086 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.214904070 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.214914083 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.216186047 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.216216087 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.217361927 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.217375040 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.218280077 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.218357086 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.219166040 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.219186068 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.220022917 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.220052958 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.222415924 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.222431898 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.222815037 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.222825050 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.224847078 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.225451946 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.226830959 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.226844072 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.227220058 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.227227926 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.240720987 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.240869045 CEST49787443192.168.2.5142.250.186.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.240890026 CEST44349787142.250.186.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.251859903 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.251910925 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.251976013 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.264050007 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.265130043 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.265162945 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.285679102 CEST49794443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.285698891 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.285995960 CEST49794443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.286012888 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533039093 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533096075 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533134937 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533180952 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533232927 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533267975 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533278942 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533305883 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533332109 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533364058 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533365011 CEST49789443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533401012 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533423901 CEST4434978913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533822060 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533852100 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.533864021 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534006119 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534049034 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534224987 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534236908 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534282923 CEST49790443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534313917 CEST4434979013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534557104 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534557104 CEST49793443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534570932 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.534579039 CEST4434979313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535067081 CEST49794443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535361052 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535413980 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535460949 CEST49791443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535476923 CEST4434979113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535860062 CEST49794443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535860062 CEST49794443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535866022 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.535871983 CEST4434979413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.541807890 CEST49798443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.541836977 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.542784929 CEST49798443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.545528889 CEST49799443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.545625925 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.546617031 CEST49800443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.546658993 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.546753883 CEST49799443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.546823978 CEST49800443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.546942949 CEST49798443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.546956062 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.549020052 CEST49799443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.549060106 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.549113035 CEST49800443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.549141884 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.549683094 CEST49802443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.549705029 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.549829960 CEST49802443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.550025940 CEST49802443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.550051928 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.550637007 CEST49803443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.550658941 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.550729036 CEST49803443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.550972939 CEST49803443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.550996065 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.830058098 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.830341101 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.830384970 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.831470966 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.831484079 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.832474947 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.833287001 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.833321095 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.834361076 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.834453106 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.834558010 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.875412941 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.875530958 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.875541925 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.935070038 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.935287952 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.935333967 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.936610937 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.936652899 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.936676025 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.936841965 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.939125061 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.939188004 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.939205885 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.939377069 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.939596891 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.939661980 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.983057022 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.983073950 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.029314995 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.129019022 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.129523039 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.129558086 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.129682064 CEST44349795142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.130722046 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.130755901 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.132916927 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.132916927 CEST49795443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.132970095 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.133137941 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.133150101 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.189834118 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.195324898 CEST49798443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.195343971 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.195724964 CEST49798443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.195729971 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.201133013 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.201487064 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.203083038 CEST49799443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.203149080 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.203311920 CEST49799443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.203327894 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.203592062 CEST49803443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.203645945 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.203905106 CEST49803443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.203921080 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.207690001 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.207993031 CEST49802443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.208024979 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.208331108 CEST49802443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.208342075 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.220606089 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.238451958 CEST49800443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.238481998 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.238779068 CEST49800443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.238790989 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.239443064 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.239516020 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.240010977 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.240036964 CEST44349797142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.240866899 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.240889072 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.241148949 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.241148949 CEST49797443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.241293907 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.241393089 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.241398096 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.292099953 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.292232037 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.292319059 CEST49798443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.292344093 CEST49798443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.292357922 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.292366028 CEST49798443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.292371035 CEST4434979813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.294589043 CEST49807443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.294657946 CEST4434980713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.294738054 CEST49807443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.294867039 CEST49807443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.294898987 CEST4434980713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.301294088 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.301368952 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.301451921 CEST49803443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.301500082 CEST49803443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.301527977 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.301570892 CEST49803443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.301584959 CEST4434980313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.303037882 CEST49808443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.303054094 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.303133965 CEST49808443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.303251982 CEST49808443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.303261995 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.307544947 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.307686090 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.307885885 CEST49802443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.307950974 CEST49802443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.307980061 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308020115 CEST49802443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308037043 CEST4434980213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308268070 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308306932 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308569908 CEST49799443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308705091 CEST49799443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308706045 CEST49799443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308751106 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.308780909 CEST4434979913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.310813904 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.310863018 CEST4434980913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.311413050 CEST49810443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.311430931 CEST4434981013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.326131105 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.326394081 CEST49810443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.327457905 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.327508926 CEST4434980913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.327543974 CEST49810443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.327574015 CEST4434981013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.339648962 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.339792013 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.341954947 CEST49800443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.342298985 CEST49800443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.342329025 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.342365026 CEST49800443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.342376947 CEST4434980013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.345401049 CEST49811443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.345418930 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.357392073 CEST49811443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.357800007 CEST49811443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.357810974 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.771469116 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.771653891 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.771667957 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.772177935 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.772238970 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.773636103 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.773689032 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.773864031 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.773938894 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.773977041 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.773984909 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.774005890 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.816339970 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.816349030 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.863190889 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.888889074 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.894330025 CEST49814443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.894366026 CEST4434981434.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.894886971 CEST49814443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.896127939 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.896136045 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.896184921 CEST49814443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.896197081 CEST4434981434.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.896754026 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.897022963 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.897756100 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.898561001 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.899125099 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.899205923 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.899259090 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.899367094 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.899370909 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.931843996 CEST4434980713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.932320118 CEST49807443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.932363033 CEST4434980713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.932786942 CEST49807443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.932797909 CEST4434980713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.941792011 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.942126989 CEST49808443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.942142010 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.942519903 CEST49808443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.942523956 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.947843075 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.947848082 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.974246025 CEST4434980913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.974733114 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.974803925 CEST4434980913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.975291014 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.975347996 CEST4434980913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.992181063 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.992511988 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.993711948 CEST4434981013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.001255035 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.001432896 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.001907110 CEST49810443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.001971006 CEST4434981013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.002235889 CEST49810443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.002252102 CEST4434981013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.002886057 CEST49805443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.002898932 CEST44349805142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.032242060 CEST4434980713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.032370090 CEST4434980713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.032497883 CEST49807443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.032497883 CEST49807443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.032547951 CEST49807443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.032574892 CEST4434980713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.035063982 CEST49815443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.035084009 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.035212040 CEST49815443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.035340071 CEST49815443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.035348892 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.041639090 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.041707039 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.042766094 CEST49808443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.042798996 CEST49808443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.042798996 CEST49808443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.042815924 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.042826891 CEST4434980813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.044651985 CEST49816443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.044737101 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.044918060 CEST49816443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.044918060 CEST49816443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.044962883 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.049037933 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.050206900 CEST49811443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.050219059 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.050533056 CEST49811443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.050539017 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.073870897 CEST4434980913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.073934078 CEST4434980913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.074172974 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.074172974 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.074172974 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.075817108 CEST49818443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.075866938 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.075938940 CEST49818443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.076037884 CEST49818443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.076066017 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.102122068 CEST4434981013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.102260113 CEST4434981013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.102624893 CEST49810443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.102626085 CEST49810443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.102801085 CEST49810443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.102843046 CEST4434981013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.104471922 CEST49819443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.104494095 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.105567932 CEST49819443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.105663061 CEST49819443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.105680943 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.129662037 CEST49820443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.129674911 CEST4434982034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.129745007 CEST49820443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.131089926 CEST49820443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.131103039 CEST4434982034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.134983063 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.135987043 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.136042118 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.136720896 CEST49806443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.136729002 CEST44349806142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.152817965 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.152987003 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.153054953 CEST49811443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.153090000 CEST49811443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.153107882 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.153137922 CEST49811443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.153147936 CEST4434981113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.154845953 CEST49821443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.154886007 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.154956102 CEST49821443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.155107021 CEST49821443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.155132055 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.218339920 CEST49822443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.218398094 CEST4434982235.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.218559980 CEST49822443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.218678951 CEST49822443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.218698025 CEST4434982235.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.302215099 CEST49809443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.302294970 CEST4434980913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.362360954 CEST4434981434.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.362958908 CEST49814443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.369699955 CEST49814443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.369714022 CEST4434981434.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.369971037 CEST4434981434.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.370053053 CEST49814443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.370069981 CEST4434981434.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.548360109 CEST49823443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.548448086 CEST4434982334.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.549113989 CEST49823443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.550370932 CEST49823443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.550405025 CEST4434982334.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.575481892 CEST4434981434.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.582412958 CEST49814443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.604665995 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.609565020 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.617502928 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.623541117 CEST4434982034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.623688936 CEST49820443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.627985001 CEST49820443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.627985001 CEST49820443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.628007889 CEST4434982034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.628269911 CEST4434982034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.629899979 CEST49820443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.659405947 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.704850912 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.705256939 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.705539942 CEST49815443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.705557108 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.705928087 CEST49815443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.705933094 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.708612919 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.711014986 CEST49816443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.711054087 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.711373091 CEST49816443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.711393118 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.711937904 CEST4434982235.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.712017059 CEST49822443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.714840889 CEST49822443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.714859962 CEST4434982235.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.715260983 CEST4434982235.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.718820095 CEST49822443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.718961954 CEST49822443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.718986988 CEST4434982235.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.719067097 CEST49822443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.720458984 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.721255064 CEST49818443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.721265078 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.721590996 CEST49818443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.721595049 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.747142076 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.752536058 CEST49824443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.752568960 CEST4434982434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.752631903 CEST49824443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.754041910 CEST49824443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.754064083 CEST4434982434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.801872969 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.802242041 CEST49819443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.802259922 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.802654982 CEST49819443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.802664995 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.803951025 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.804075956 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.804138899 CEST49815443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.804281950 CEST49815443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.804297924 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.804306984 CEST49815443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.804311991 CEST4434981513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.806653023 CEST49825443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.806690931 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.806822062 CEST49825443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.806950092 CEST49825443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.806962013 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.808464050 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.808609009 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.809160948 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.809168100 CEST49816443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.809684038 CEST49816443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.809684038 CEST49816443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.809711933 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.809726954 CEST4434981613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.810398102 CEST49821443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.810419083 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.810748100 CEST49821443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.810755968 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.811563969 CEST49826443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.811589003 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.811691999 CEST49826443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.811794996 CEST49826443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.811806917 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.821177959 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.821242094 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.821312904 CEST49818443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.821444988 CEST49818443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.821444988 CEST49818443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.821472883 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.821495056 CEST4434981813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.823124886 CEST49827443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.823177099 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.823551893 CEST49827443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.823697090 CEST49827443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.823729038 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.835035086 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.839960098 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.885090113 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.885128975 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.885163069 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.885199070 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.885534048 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.887223005 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.887394905 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.891191006 CEST49736443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.891210079 CEST44349736172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.892303944 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.904871941 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.905021906 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.906389952 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.906434059 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.907427073 CEST49819443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.907524109 CEST49821443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.907748938 CEST49819443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.907748938 CEST49819443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.907759905 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.907768011 CEST4434981913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.908874989 CEST49821443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.908921957 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.908952951 CEST49821443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.908968925 CEST4434982113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.912955999 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.912972927 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.913222075 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.913496971 CEST49829443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.913568974 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.913911104 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.913930893 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.915081024 CEST49829443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.915329933 CEST49829443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.915364027 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.936471939 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.983613014 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.984206915 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.031291962 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.038844109 CEST4434982334.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.038927078 CEST49823443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.042618990 CEST49823443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.042637110 CEST4434982334.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.042876005 CEST49823443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.042927980 CEST4434982334.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.043220043 CEST49823443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.193594933 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.194278955 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.277457952 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.277467012 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.283046007 CEST4434982434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.283374071 CEST49824443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.287909985 CEST49824443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.287914991 CEST4434982434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.288018942 CEST49824443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.288245916 CEST4434982434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.288333893 CEST49824443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.367100954 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.371184111 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.416601896 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.417177916 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.439946890 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.445143938 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.457546949 CEST49832443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.457583904 CEST4434983234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.457954884 CEST49833443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.458040953 CEST4434983334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.458089113 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.458110094 CEST4434983434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.458297014 CEST49832443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.458436966 CEST49833443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.458436966 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.460217953 CEST49832443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.460230112 CEST4434983234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.460495949 CEST49833443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.460537910 CEST4434983334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.460577011 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.460599899 CEST4434983434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.489020109 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.489605904 CEST49827443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.489662886 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.490140915 CEST49827443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.490159988 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.508255005 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.508832932 CEST49826443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.508893967 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.509465933 CEST49826443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.509480000 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.517147064 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.518615007 CEST49825443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.518647909 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.519038916 CEST49825443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.519048929 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.540446043 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.578591108 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.579067945 CEST49829443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.579128981 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.579607964 CEST49829443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.579622030 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.592389107 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.592444897 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.592514992 CEST49827443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.592674017 CEST49827443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.592711926 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.592741013 CEST49827443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.592758894 CEST4434982713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.595513105 CEST49835443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.595542908 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.595799923 CEST49835443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.596282959 CEST49835443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.596295118 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.601557970 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.611031055 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.611151934 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.611263990 CEST49826443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.611310959 CEST49826443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.611310959 CEST49826443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.611344099 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.611367941 CEST4434982613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.614564896 CEST49836443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.614593983 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.614667892 CEST49836443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.614840031 CEST49836443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.614851952 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.621376038 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.621496916 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.621592045 CEST49825443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.621622086 CEST49825443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.621634007 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.621680975 CEST49825443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.621694088 CEST4434982513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.624311924 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.624398947 CEST4434983713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.624596119 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.624804974 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.624841928 CEST4434983713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.907028913 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.907116890 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.918236971 CEST49829443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.953531981 CEST4434983434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.954616070 CEST4434983234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.954797983 CEST4434983334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.963408947 CEST4434983234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.963411093 CEST4434983334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.963445902 CEST4434983434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.964996099 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.966744900 CEST49832443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.967811108 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.967842102 CEST4434983434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.968727112 CEST4434983434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.976110935 CEST49833443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.976126909 CEST49832443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.976141930 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.017486095 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.123157978 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.147166014 CEST49829443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.147166014 CEST49829443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.147224903 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.147250891 CEST4434982913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.178739071 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.189748049 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.189765930 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.190253019 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.190258980 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.200589895 CEST49838443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.200676918 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.200815916 CEST49838443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.200980902 CEST49838443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.201000929 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.259516001 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.261410952 CEST49835443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.261423111 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.261842012 CEST49835443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.261846066 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.271359921 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.272382975 CEST49836443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.272411108 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.272770882 CEST49836443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.272775888 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.291793108 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.291862011 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.292330027 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.292526007 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.292536020 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.292542934 CEST49828443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.292546988 CEST4434982813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.310928106 CEST49840443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.310992002 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.311157942 CEST49840443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.312230110 CEST49840443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.312261105 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.336647034 CEST4434983713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.337131023 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.337193012 CEST4434983713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.337410927 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.337426901 CEST4434983713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.363610029 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.363657951 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.363791943 CEST49835443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.363826990 CEST49835443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.363838911 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.363847971 CEST49835443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.363852024 CEST4434983513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.367268085 CEST49841443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.367280006 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.367420912 CEST49841443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.367660999 CEST49841443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.367685080 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.374330044 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.374471903 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.374533892 CEST49836443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.374561071 CEST49836443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.374574900 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.374584913 CEST49836443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.374589920 CEST4434983613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.377379894 CEST49842443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.377388000 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.377756119 CEST49842443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.378036022 CEST49842443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.378047943 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.441152096 CEST4434983713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.441289902 CEST4434983713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.441513062 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.441514015 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.441514015 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.444622040 CEST49843443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.444686890 CEST4434984313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.444767952 CEST49843443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.444945097 CEST49843443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.444973946 CEST4434984313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.479051113 CEST49833443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.479134083 CEST4434983334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.479676008 CEST4434983334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.482245922 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.482245922 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.482542038 CEST4434983434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.483299971 CEST49833443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.483362913 CEST49833443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.483552933 CEST4434983334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.483967066 CEST49834443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.483967066 CEST49833443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.485171080 CEST49832443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.485194921 CEST4434983234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.485255957 CEST49832443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.485791922 CEST4434983234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.485856056 CEST49832443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.748768091 CEST49837443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.748831034 CEST4434983713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.848478079 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.849066973 CEST49838443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.849128008 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.849467993 CEST49838443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.849483013 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.961242914 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.961389065 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.961515903 CEST49838443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.961976051 CEST49838443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.962011099 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.962037086 CEST49838443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.962050915 CEST4434983813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.966303110 CEST49844443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.966345072 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.966880083 CEST49844443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.967926025 CEST49844443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.967945099 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.973601103 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.975601912 CEST49840443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.975657940 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.976063013 CEST49840443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:26.976075888 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.056973934 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.057322025 CEST49841443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.057338953 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.057710886 CEST49841443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.057715893 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.072535038 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.072717905 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.072839022 CEST49840443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.072892904 CEST49840443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.072892904 CEST49840443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.072923899 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.072947025 CEST4434984013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.073972940 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.076289892 CEST49842443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.076297998 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.076680899 CEST49842443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.076688051 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.077965021 CEST49845443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.078048944 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.078244925 CEST49845443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.078380108 CEST49845443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.078402042 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.086488008 CEST4434984313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.088742971 CEST49843443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.088783026 CEST4434984313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.089122057 CEST49843443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.089133978 CEST4434984313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.157074928 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.157133102 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.167396069 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.168200970 CEST49841443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.174649954 CEST49841443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.174662113 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.174669981 CEST49841443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.174674988 CEST4434984113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.181286097 CEST49846443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.181324005 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.181510925 CEST49846443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.181982040 CEST49846443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.182009935 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.185714960 CEST4434984313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.185853004 CEST4434984313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.185980082 CEST49843443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.185980082 CEST49843443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186024904 CEST49843443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186044931 CEST4434984313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186299086 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186445951 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186769962 CEST49842443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186933994 CEST49842443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186939001 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186947107 CEST49842443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.186949968 CEST4434984213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.188545942 CEST49847443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.188586950 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.188769102 CEST49848443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.188819885 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.188853025 CEST49847443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.189192057 CEST49847443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.189208984 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.189306021 CEST49848443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.189661980 CEST49848443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.189687967 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.609391928 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.609945059 CEST49844443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.609977007 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.610425949 CEST49844443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.610433102 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.709039927 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.709168911 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.709314108 CEST49844443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.709352970 CEST49844443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.709352970 CEST49844443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.709374905 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.709387064 CEST4434984413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.713613033 CEST49849443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.713648081 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.713752031 CEST49849443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.713973045 CEST49849443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.713984013 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.719176054 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.719556093 CEST49845443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.719614983 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.719945908 CEST49845443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.719959021 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.821677923 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.822175026 CEST49846443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.822216034 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.822594881 CEST49846443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.822607994 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.827719927 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.827832937 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.827914000 CEST49845443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.828003883 CEST49845443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.828037024 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.828062057 CEST49845443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.828075886 CEST4434984513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.831012964 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.831047058 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.831124067 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.831446886 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.831459999 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.839855909 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.840895891 CEST49848443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.840924025 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.841582060 CEST49848443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.841598034 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.842047930 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.842744112 CEST49847443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.842765093 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.843029976 CEST49847443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.843035936 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.902409077 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.921173096 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.981286049 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.981416941 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.982225895 CEST49847443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.982803106 CEST49847443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.982824087 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.982836962 CEST49847443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.982844114 CEST4434984713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.985639095 CEST49851443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.985726118 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.986052036 CEST49851443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.986274958 CEST49851443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.986309052 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.996140003 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.996336937 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.997338057 CEST49848443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.998509884 CEST49848443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.998509884 CEST49848443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.998534918 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.998558044 CEST4434984813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.001832962 CEST49852443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.001867056 CEST4434985213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.002006054 CEST49852443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.002252102 CEST49852443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.002269983 CEST4434985213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.048496962 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.050983906 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.078145027 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.091295958 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.149313927 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.199603081 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.386179924 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.388060093 CEST49849443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.388089895 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.388559103 CEST49849443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.388564110 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.484985113 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.489386082 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.489526033 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.495421886 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.513947964 CEST49849443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.545156002 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.556735992 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.556750059 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.564981937 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.564991951 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.595005989 CEST49849443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.595005989 CEST49849443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.595032930 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.595042944 CEST4434984913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.663161039 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.663218021 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.663619995 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.668035030 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.668050051 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.668060064 CEST49850443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.668065071 CEST4434985013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.686228037 CEST49853443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.686260939 CEST4434985313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.686822891 CEST49854443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.686832905 CEST4434985413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.689198971 CEST49854443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.689198971 CEST49853443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.695429087 CEST49853443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.695441008 CEST4434985313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.695524931 CEST49854443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.695533037 CEST4434985413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.703728914 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.706778049 CEST49851443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.706865072 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.707075119 CEST4434985213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.707223892 CEST49851443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.707237959 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.707447052 CEST49852443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.707468987 CEST4434985213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.707797050 CEST49852443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.707803011 CEST4434985213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.805496931 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.805639982 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.805742979 CEST49851443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.805918932 CEST49851443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.805918932 CEST49851443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.805977106 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.805991888 CEST4434985113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.808974981 CEST49855443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.809000015 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.809194088 CEST49855443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.809330940 CEST49855443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.809344053 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.811008930 CEST4434985213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.811147928 CEST4434985213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.811604023 CEST49852443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.811604023 CEST49852443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.813678980 CEST49852443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.813684940 CEST4434985213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.813688040 CEST49856443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.813734055 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.815021992 CEST49856443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.815231085 CEST49856443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.815265894 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.547220945 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.547734022 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.547827959 CEST49846443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.547914982 CEST49846443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.547914982 CEST49846443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.547956944 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.547982931 CEST4434984613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.550896883 CEST49857443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.550925016 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.551054955 CEST49857443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.551187992 CEST49857443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.551193953 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.679991007 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.680224895 CEST4434985413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.688662052 CEST49856443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.688694000 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.689126015 CEST49856443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.689131975 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.689327955 CEST49854443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.689338923 CEST4434985413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.689645052 CEST49854443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.689650059 CEST4434985413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.787333012 CEST4434985413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.787503958 CEST4434985413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.787619114 CEST49854443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.787620068 CEST49854443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.787703037 CEST49854443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.787718058 CEST4434985413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.791220903 CEST49858443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.791259050 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.791317940 CEST49858443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.791505098 CEST49858443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.791510105 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.819519997 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.819715977 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.819820881 CEST49856443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.819981098 CEST49856443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.819982052 CEST49856443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.820039988 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.820053101 CEST4434985613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.822127104 CEST49859443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.822177887 CEST4434985913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.822300911 CEST49859443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.822650909 CEST49859443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.822688103 CEST4434985913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.004097939 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.004343033 CEST4434985313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.004775047 CEST49855443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.004796982 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.005079985 CEST49855443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.005086899 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.005332947 CEST49853443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.005342960 CEST4434985313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.005666971 CEST49853443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.005672932 CEST4434985313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.023024082 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.023102045 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.023565054 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.023916960 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.023948908 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.128285885 CEST4434985313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.128416061 CEST4434985313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.129102945 CEST49853443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.129102945 CEST49853443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.129132986 CEST49853443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.129143953 CEST4434985313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.129626989 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.129774094 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.129968882 CEST49855443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.130223036 CEST49855443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.130223036 CEST49855443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.130240917 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.130253077 CEST4434985513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.131861925 CEST49861443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.131881952 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.132415056 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.132415056 CEST49861443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.132422924 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.132512093 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.132512093 CEST49861443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.132530928 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.132617950 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.132627964 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.214400053 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.214718103 CEST49857443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.214745998 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.215063095 CEST49857443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.215068102 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.313481092 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.313642025 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.313725948 CEST49857443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.313747883 CEST49857443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.313765049 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.313775063 CEST49857443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.313780069 CEST4434985713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.316184998 CEST49863443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.316221952 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.316299915 CEST49863443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.316431046 CEST49863443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.316446066 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.458575010 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.458897114 CEST49858443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.458909035 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.459319115 CEST49858443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.459322929 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.505564928 CEST4434985913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.505971909 CEST49859443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.506026983 CEST4434985913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.506288052 CEST49859443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.506300926 CEST4434985913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.569171906 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.569209099 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.569264889 CEST49858443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.569437027 CEST49858443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.569449902 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.569458008 CEST49858443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.569463015 CEST4434985813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.571738958 CEST49864443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.571801901 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.571873903 CEST49864443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.572005987 CEST49864443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.572036028 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.608793974 CEST4434985913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.608937979 CEST4434985913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.609008074 CEST49859443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.609009027 CEST49859443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.609069109 CEST49859443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.609101057 CEST4434985913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.610868931 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.610903978 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.612932920 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.613130093 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.613162994 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.690146923 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.690402031 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.690434933 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.691514969 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.692212105 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.692302942 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.692374945 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.692408085 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.692481041 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.737879038 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.776541948 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.780925035 CEST49861443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.780934095 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.781548023 CEST49861443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.781552076 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.788678885 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.791155100 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.791163921 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.791682959 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.791687965 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.891148090 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.891192913 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.891267061 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.891278028 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.891319990 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.892483950 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.892508984 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.892520905 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.892527103 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.893595934 CEST49862443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.893601894 CEST4434986213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.895778894 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.895819902 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.902708054 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.903213978 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.903240919 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:30.963490963 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.019995928 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.020339966 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.027728081 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.036932945 CEST49863443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.036974907 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.037318945 CEST49863443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.037327051 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.089262962 CEST49860443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.089294910 CEST44349860142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.136296034 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.136445999 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.148955107 CEST49863443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.172700882 CEST49863443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.172729015 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.172744036 CEST49863443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.172751904 CEST4434986313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.175687075 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.175729036 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.189389944 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.190897942 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.190924883 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.208314896 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.215970039 CEST49864443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.216005087 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.222388983 CEST49864443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.222398996 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.249814987 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.258543015 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.258564949 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.259011984 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.259017944 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.318401098 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.318445921 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.318800926 CEST49864443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.318870068 CEST49864443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.318895102 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.318919897 CEST49864443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.318933010 CEST4434986413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.321451902 CEST49868443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.321491957 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.321876049 CEST49868443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.322065115 CEST49868443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.322074890 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355016947 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355047941 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355118036 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355137110 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355416059 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355429888 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355444908 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355576992 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.355614901 CEST4434986513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.356556892 CEST49865443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.358810902 CEST49869443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.358869076 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.359311104 CEST49869443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.359411001 CEST49869443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.359422922 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.556746006 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.557216883 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.557229996 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.557800055 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.557806015 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.655781031 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.655832052 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.655898094 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.655910015 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.655952930 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.656120062 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.656142950 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.656163931 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.656178951 CEST49866443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.656187057 CEST4434986613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.660480022 CEST49870443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.660564899 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.660665035 CEST49870443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.660938978 CEST49870443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.660981894 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.870726109 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.871313095 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.871351957 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.871913910 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.871929884 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.970365047 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.970921993 CEST49868443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.970964909 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.971532106 CEST49868443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.971545935 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.975703955 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.975733995 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.975816965 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.975824118 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.976005077 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.976049900 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.976049900 CEST49867443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.976090908 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.976115942 CEST4434986713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.979140997 CEST49871443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.979202032 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.979290009 CEST49871443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.979490042 CEST49871443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.979521036 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.026655912 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.027107000 CEST49869443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.027162075 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.027661085 CEST49869443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.027674913 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.075660944 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.075712919 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.075912952 CEST49868443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.075979948 CEST49868443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.075979948 CEST49868443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.076014996 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.076036930 CEST4434986813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.079752922 CEST49872443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.079798937 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.080164909 CEST49872443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.080518961 CEST49872443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.080532074 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.131211042 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.131870031 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.131958961 CEST49869443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.132045031 CEST49869443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.132045031 CEST49869443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.132091045 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.132118940 CEST4434986913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.134649992 CEST49873443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.134682894 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.134829044 CEST49873443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.135557890 CEST49873443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.135575056 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.311316013 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.311849117 CEST49870443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.311912060 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.312439919 CEST49870443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.312454939 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.412107944 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.412247896 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.412408113 CEST49870443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.412492037 CEST49870443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.412492037 CEST49870443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.412540913 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.412573099 CEST4434987013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.415463924 CEST49874443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.415494919 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.415596962 CEST49874443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.415781021 CEST49874443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.415795088 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.723344088 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.723869085 CEST49871443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.723922968 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.724782944 CEST49871443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.724802017 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.771542072 CEST49875443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.771634102 CEST4434987534.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.771794081 CEST49875443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.773791075 CEST49875443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:32.773827076 CEST4434987534.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.158303022 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.158935070 CEST49873443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.158963919 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.159586906 CEST49873443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.159591913 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.253402948 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.253578901 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.254196882 CEST49871443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.254551888 CEST49871443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.254604101 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.254632950 CEST49871443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.254650116 CEST4434987113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.258487940 CEST49876443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.258533001 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.258682966 CEST49876443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.259048939 CEST49876443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.259061098 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.276948929 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.277654886 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.279150963 CEST49873443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.279963017 CEST49873443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.279978991 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.279988050 CEST49873443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.279993057 CEST4434987313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.283504009 CEST49877443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.283582926 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.288674116 CEST49877443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.288882971 CEST49877443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.288924932 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.353791952 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.355007887 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.360948086 CEST49872443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.360971928 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.361602068 CEST49872443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.361609936 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.361979008 CEST49874443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.361991882 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.362476110 CEST49874443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.362479925 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.457618952 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.457683086 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.457753897 CEST49874443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.458029985 CEST49874443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.458036900 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.458046913 CEST49874443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.458050966 CEST4434987413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.459084988 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.459152937 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.459501982 CEST49872443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.459717989 CEST49872443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.459741116 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.459753036 CEST49872443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.459759951 CEST4434987213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.462126017 CEST49878443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.462198973 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.462502956 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.462531090 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.462702990 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.462717056 CEST49878443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.463671923 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.463681936 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.463781118 CEST49878443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.463820934 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.631213903 CEST6150253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.632664919 CEST4434987534.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.632755041 CEST49875443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.636327982 CEST53615021.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.636424065 CEST6150253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.636462927 CEST6150253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.641422987 CEST53615021.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.932085037 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.932617903 CEST49876443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.932648897 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.933228016 CEST49876443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.933234930 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.944356918 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.944816113 CEST49877443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.944840908 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.945338011 CEST49877443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.945344925 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.043368101 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.043538094 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.043637037 CEST49877443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.043668032 CEST49877443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.043687105 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.043699980 CEST49877443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.043706894 CEST4434987713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.047471046 CEST61503443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.047513962 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.047601938 CEST61503443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.047782898 CEST61503443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.047790051 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.058633089 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.058772087 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.058835983 CEST49876443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.058881998 CEST49876443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.058881998 CEST49876443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.058900118 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.058911085 CEST4434987613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.062232018 CEST61504443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.062256098 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.062412977 CEST61504443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.062544107 CEST61504443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.062558889 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.091197014 CEST53615021.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.091862917 CEST6150253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.097222090 CEST53615021.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.097337008 CEST6150253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.116389990 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.116794109 CEST49878443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.116812944 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.117168903 CEST49878443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.117173910 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.128362894 CEST49875443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.128379107 CEST4434987534.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.128449917 CEST49875443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.129030943 CEST4434987534.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.129110098 CEST49875443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.147955894 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.148340940 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.148360968 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.148682117 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.148689985 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.221432924 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.221877098 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.221935987 CEST49878443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.221962929 CEST49878443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.221962929 CEST49878443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.221975088 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.221983910 CEST4434987813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.224319935 CEST61506443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.224344969 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.224453926 CEST61506443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.224612951 CEST61506443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.224620104 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.236305952 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.241296053 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.246082067 CEST61507443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.246094942 CEST4436150735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.246506929 CEST61507443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.246649981 CEST61507443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.246670961 CEST4436150735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253446102 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253767014 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253815889 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253829002 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253884077 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253918886 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253933907 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253946066 CEST49879443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.253952026 CEST4434987913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.256422043 CEST61508443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.256457090 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.256710052 CEST61508443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.256869078 CEST61508443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.256884098 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.332433939 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.382199049 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.635498047 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.640456915 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.644625902 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.644666910 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.645189047 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.645366907 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.645385027 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.687753916 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.687797070 CEST4436151034.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.688174009 CEST61511443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.688201904 CEST4436151135.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.692357063 CEST61511443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.692359924 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.692410946 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.692418098 CEST4436151034.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.693636894 CEST61511443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.693651915 CEST4436151135.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.698241949 CEST61512443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.698268890 CEST4436151235.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.698329926 CEST61512443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.699532986 CEST61512443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.699553013 CEST4436151235.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.702689886 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.703048944 CEST61503443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.703063011 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.703443050 CEST61503443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.703449965 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.711023092 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.712786913 CEST4436150735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.714457035 CEST61507443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.718415976 CEST61507443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.718424082 CEST4436150735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.718544006 CEST61504443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.718556881 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.718960047 CEST61504443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.718965054 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.718986988 CEST4436150735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.726741076 CEST61507443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.726865053 CEST61507443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.727497101 CEST4436150735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.727560043 CEST61507443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.733819008 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.783328056 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.809868097 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.810447931 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.810544968 CEST61503443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.810893059 CEST61503443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.810910940 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.810942888 CEST61503443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.810950994 CEST4436150313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.813919067 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.814007044 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.814120054 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.814268112 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.814291954 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.815072060 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.815253019 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.815356970 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.815509081 CEST61504443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.815563917 CEST61504443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.815563917 CEST61504443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.815583944 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.815593958 CEST4436150413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.817513943 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.817537069 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.817614079 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.817769051 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.817792892 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.895198107 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.895498991 CEST61506443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.895509958 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.895870924 CEST61506443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.895874977 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.934412003 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.936764956 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.937074900 CEST61508443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.937105894 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.937426090 CEST61508443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.937431097 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.939563036 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.998898029 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.999159098 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.001401901 CEST61506443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.001604080 CEST61506443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.001616955 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.001646996 CEST61506443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.001652956 CEST4436150613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.010574102 CEST61515443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.010607958 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.013520956 CEST61515443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.013521910 CEST61515443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.013560057 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.030848026 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.040106058 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.040324926 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.041280031 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.042418003 CEST61508443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.043709993 CEST61508443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.043725014 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.043736935 CEST61508443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.043742895 CEST4436150813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.046478987 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.047290087 CEST61516443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.047322035 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.047516108 CEST61516443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.047951937 CEST61516443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.047986031 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.084225893 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.141155958 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.167829037 CEST4436151034.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.167923927 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.170535088 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.170547962 CEST4436151034.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.171305895 CEST4436151034.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.172488928 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.172558069 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.172657967 CEST4436151034.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.173082113 CEST4436151135.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.175030947 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.175050974 CEST61510443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.175079107 CEST61511443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.178435087 CEST61511443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.178446054 CEST4436151135.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.178498983 CEST61511443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.178709984 CEST4436151135.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.179023981 CEST61511443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.180860996 CEST4436151235.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.180941105 CEST61512443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.184273005 CEST61512443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.184282064 CEST4436151235.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.184333086 CEST61512443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.184542894 CEST4436151235.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.199343920 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.200032949 CEST61512443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.200082064 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.204375982 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.219579935 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.219611883 CEST4436151734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.220144987 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.220406055 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.220421076 CEST4436151734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.295692921 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.310497046 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.315454960 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.339740992 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.388683081 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.399432898 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.399938107 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.400130033 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.411098957 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.441198111 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.441205978 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.441586018 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.460602999 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.487735987 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.487940073 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.492064953 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.492078066 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.502392054 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.503103971 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.559739113 CEST61518443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.559782028 CEST4436151835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.561202049 CEST61518443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.561332941 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.561387062 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.561558008 CEST61518443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.561577082 CEST4436151835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.568753004 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.568782091 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.568818092 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.568828106 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.569185972 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.569195986 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.569363117 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.569372892 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.569961071 CEST61519443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.570034981 CEST4436151935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.571090937 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.571206093 CEST61520443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.571244955 CEST4436152035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.572145939 CEST61519443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.572211981 CEST61520443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.572294950 CEST61519443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.572315931 CEST4436151935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.572381973 CEST61520443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.572402954 CEST4436152035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.576040030 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.666852951 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.668426991 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.668468952 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.668535948 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.668633938 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.669167995 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.669816971 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.670284986 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.670288086 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.671242952 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.671274900 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.671376944 CEST61513443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.671410084 CEST4436151313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.672584057 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.672584057 CEST61514443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.672600985 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.672620058 CEST4436151413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.673057079 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.675271034 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.675462008 CEST61515443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.675482988 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.676567078 CEST61515443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.676574945 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.678525925 CEST61521443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.678548098 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.678966999 CEST61522443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.678966999 CEST61521443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.678977966 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.679085016 CEST61521443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.679104090 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.679215908 CEST61522443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.679306030 CEST61522443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.679328918 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.703119993 CEST4436151734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.703186035 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.703401089 CEST4436150952.222.236.23192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.706310034 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.706316948 CEST4436151734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.706634045 CEST4436151734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.708332062 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.708332062 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.708580971 CEST4436151734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.711177111 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.712064981 CEST61509443192.168.2.552.222.236.23
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.712094069 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.712094069 CEST61517443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.716212034 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.743237019 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.752126932 CEST61516443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.752146959 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.752496004 CEST61516443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.752501965 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.770184994 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.779170036 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.779252052 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.779472113 CEST61515443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.779661894 CEST61515443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.779689074 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.779695988 CEST61515443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.779704094 CEST4436151513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.782638073 CEST61523443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.782661915 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.785443068 CEST61523443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.785665989 CEST61523443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.785675049 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.806704044 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.812385082 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.817343950 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.855493069 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.855556965 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.855717897 CEST61516443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.856334925 CEST61516443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.856349945 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.856363058 CEST61516443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.856369019 CEST4436151613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.856941938 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.859899998 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.859949112 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.860029936 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.860181093 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.860191107 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.926965952 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.981991053 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.025094986 CEST4436151835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.028760910 CEST61518443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.033073902 CEST61518443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.033080101 CEST4436151835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.033689976 CEST4436151835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.037292004 CEST61518443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.037436962 CEST61518443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.037616014 CEST4436151835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.041332960 CEST4436151935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.042301893 CEST61518443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.042463064 CEST61519443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.045345068 CEST4434975023.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.047714949 CEST61519443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.047736883 CEST4436151935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.048069954 CEST4436151935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.048211098 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.049699068 CEST49750443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.051912069 CEST61519443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.052043915 CEST61519443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.052385092 CEST4436151935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.052612066 CEST61519443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.053087950 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.056073904 CEST4436152035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.056502104 CEST61520443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.061470032 CEST61520443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.061482906 CEST4436152035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.062226057 CEST4436152035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.065478086 CEST61520443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.065532923 CEST61520443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.065841913 CEST4436152035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.066920996 CEST61520443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.161406040 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.164942980 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.169904947 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.214939117 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.229252100 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.229588032 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.229692936 CEST49861443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.229732037 CEST49861443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.229753017 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.229769945 CEST49861443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.229779005 CEST4434986113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.233386993 CEST61526443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.233432055 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.233511925 CEST61526443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.233721972 CEST61526443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.233732939 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.269772053 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.320641994 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.350790977 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.351361036 CEST61522443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.351375103 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.352308989 CEST61522443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.352314949 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.360840082 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.361287117 CEST61521443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.361294985 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.361829996 CEST61521443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.361835003 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.442048073 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.442457914 CEST61523443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.442470074 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.443052053 CEST61523443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.443057060 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.449795961 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.449877977 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.449974060 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.450144053 CEST61522443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.450376034 CEST61522443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.450397968 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.450414896 CEST61522443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.450423002 CEST4436152213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.454329014 CEST61527443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.454372883 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.454571962 CEST61527443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.454649925 CEST61527443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.454668045 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.465738058 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.465801001 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.465878010 CEST61521443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.465972900 CEST61521443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.465979099 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.465991974 CEST61521443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.465996981 CEST4436152113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.468648911 CEST61528443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.468719006 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.480241060 CEST61528443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.480510950 CEST61528443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.480551958 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.540210962 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.541348934 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.541372061 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.541953087 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.541973114 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.543102026 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.544002056 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.552992105 CEST61523443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.553713083 CEST61523443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.553725958 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.553735971 CEST61523443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.553740025 CEST4436152313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.566840887 CEST61529443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.566868067 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.567121029 CEST61529443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.567496061 CEST61529443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.567511082 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644037962 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644519091 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644572020 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644617081 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644682884 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644757986 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644769907 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644783020 CEST61524443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.644788980 CEST4436152413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.647754908 CEST61530443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.647769928 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.647856951 CEST61530443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.648055077 CEST61530443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.648070097 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.136817932 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.137371063 CEST61526443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.137391090 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.138031960 CEST61526443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.138037920 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.142755985 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.143137932 CEST61527443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.143170118 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.143685102 CEST61527443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.143702030 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.153059006 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.153450966 CEST61528443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.153513908 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.153980017 CEST61528443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.153999090 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.213032961 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.216125011 CEST61529443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.216183901 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.216962099 CEST61529443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.216976881 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.243171930 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.243324041 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.247111082 CEST61526443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.247400045 CEST61526443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.247419119 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.247431993 CEST61526443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.247438908 CEST4436152613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.255376101 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.255470037 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.255932093 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.256091118 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.256122112 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.259526968 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.259711981 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.259788036 CEST61528443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.259937048 CEST61528443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.259949923 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.259984016 CEST61528443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.259989977 CEST4436152813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.262422085 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.262481928 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.262751102 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.262926102 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.262957096 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.299406052 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.300848961 CEST61530443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.300870895 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.301532030 CEST61530443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.301542997 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313337088 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313457012 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313538074 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313679934 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313827038 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313848972 CEST61529443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313934088 CEST61529443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313965082 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.313992977 CEST61529443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.314007998 CEST4436152913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.319422960 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.320010900 CEST61527443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.320550919 CEST61527443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.320580006 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.320605993 CEST61527443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.320621014 CEST4436152713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.325129032 CEST61533443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.325160027 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.325273037 CEST61534443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.325280905 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.325459957 CEST61533443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.325596094 CEST61534443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.333020926 CEST61533443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.333039999 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.333168030 CEST61534443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.333179951 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.399435997 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.400398016 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.400465965 CEST61530443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.400563002 CEST61530443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.400563002 CEST61530443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.400584936 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.400604963 CEST4436153013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.404057980 CEST61535443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.404131889 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.404844046 CEST61535443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.404946089 CEST61535443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.404963017 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.948031902 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.950453043 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.970530987 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.974237919 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:38.998552084 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.002836943 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.009418964 CEST61534443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.009426117 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.009845972 CEST61534443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.009850025 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.010044098 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.010070086 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.010325909 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.010339975 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.010607004 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.010632992 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.010907888 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.010919094 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.022910118 CEST61533443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.022917986 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.023250103 CEST61533443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.023253918 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.047799110 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.048134089 CEST61535443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.048156977 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.048482895 CEST61535443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.048494101 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.106481075 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.106503010 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.106535912 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.107594967 CEST61534443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.107753992 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.107897043 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108031034 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108095884 CEST61534443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108112097 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108127117 CEST61534443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108139038 CEST4436153413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108258009 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108290911 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108352900 CEST61531443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.108369112 CEST4436153113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.110510111 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111186981 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111190081 CEST61537443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111210108 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111212969 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111252069 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111366034 CEST61537443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111466885 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111466885 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111536026 CEST61537443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111541986 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111545086 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111562014 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111599922 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111599922 CEST61532443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111623049 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.111644983 CEST4436153213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.113342047 CEST61538443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.113351107 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.115586996 CEST61538443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.115935087 CEST61538443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.115945101 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.118757963 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.118896961 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.122822046 CEST61533443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.123430967 CEST61533443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.123436928 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.123469114 CEST61533443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.123475075 CEST4436153313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.125231028 CEST61539443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.125258923 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.125396967 CEST61539443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.125507116 CEST61539443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.125531912 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.146784067 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.147053003 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.147118092 CEST61535443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.147151947 CEST61535443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.147166014 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.147207022 CEST61535443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.147221088 CEST4436153513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.148854971 CEST61540443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.148917913 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.148999929 CEST61540443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.149090052 CEST61540443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.149116039 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.754297972 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.754791975 CEST61538443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.754802942 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.755239964 CEST61538443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.755247116 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.779536963 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.779887915 CEST61537443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.779905081 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.780258894 CEST61537443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.780265093 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.780765057 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.781115055 CEST61539443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.781193018 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.781439066 CEST61539443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.781452894 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.785113096 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.785413027 CEST61540443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.785440922 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.785758018 CEST61540443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.785763979 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.791840076 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.792160034 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.792186975 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.792495012 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.792504072 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.853879929 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.854008913 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.854118109 CEST61538443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.854139090 CEST61538443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.854154110 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.854166031 CEST61538443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.854171991 CEST4436153813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.856834888 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.856918097 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.857007027 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.857108116 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.857126951 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.880528927 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.881067991 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.881139994 CEST61539443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.881194115 CEST61539443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.881194115 CEST61539443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.881231070 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.881253004 CEST4436153913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.883018017 CEST61542443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.883043051 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.883176088 CEST61542443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.883291006 CEST61542443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.883312941 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.884648085 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.884721041 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.884772062 CEST61537443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.884828091 CEST61537443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.884828091 CEST61537443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.884836912 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.884861946 CEST4436153713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886096954 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886151075 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886508942 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886544943 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886559010 CEST61540443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886648893 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886648893 CEST61540443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886648893 CEST61540443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886681080 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886691093 CEST4436154013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886760950 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.886770010 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.888465881 CEST61544443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.888550043 CEST4436154413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.888623953 CEST61544443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.888730049 CEST61544443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.888763905 CEST4436154413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.897959948 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.898005009 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.898053885 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.898086071 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.898191929 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.898219109 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.898236036 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.898257971 CEST61536443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.898272038 CEST4436153613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.900270939 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.900293112 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.900350094 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.900476933 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:39.900487900 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.540916920 CEST4436154413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.541531086 CEST61544443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.541593075 CEST4436154413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.541882992 CEST61544443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.541898966 CEST4436154413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.546972990 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.547318935 CEST61542443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.547410965 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.547668934 CEST61542443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.547684908 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.550115108 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.550415993 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.550458908 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.550753117 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.550765038 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.555460930 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.555820942 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.555835009 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.556133986 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.556143999 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.562423944 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.562717915 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.562737942 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.563060045 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.563064098 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.640357971 CEST4436154413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.640701056 CEST4436154413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.640829086 CEST61544443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.640829086 CEST61544443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.640924931 CEST61544443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.640963078 CEST4436154413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.643621922 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.643652916 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.643779039 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.643894911 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.643899918 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.646028996 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.646194935 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.646274090 CEST61542443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.646325111 CEST61542443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.646358967 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.646387100 CEST61542443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.646399975 CEST4436154213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.648178101 CEST61547443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.648242950 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.648324013 CEST61547443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.648432016 CEST61547443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.648459911 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649480104 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649557114 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649655104 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649682999 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649734020 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649765015 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649804115 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649837971 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649852991 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649890900 CEST61543443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.649900913 CEST4436154313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.651490927 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.651515961 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.651623011 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.651736021 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.651746035 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.660722017 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.661561012 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.661590099 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.661623001 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.661653042 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.661709070 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.661720991 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.661747932 CEST61541443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.661760092 CEST4436154113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.663559914 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.663589001 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.663727045 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.663839102 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.663852930 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.664999008 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.665070057 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.665169001 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.665196896 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.665268898 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.665297031 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.665307045 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.665316105 CEST61545443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.665319920 CEST4436154513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.667290926 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.667301893 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.667387009 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.667495966 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:40.667506933 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.315120935 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.326270103 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.338561058 CEST61547443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.338654995 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.339154959 CEST61547443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.339169025 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.339423895 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.339440107 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.339951992 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.339956999 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.401398897 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.403557062 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.415585995 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.450771093 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.450849056 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.457149982 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.457159042 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.465853930 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.465859890 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.470504999 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.470515966 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.471012115 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.477690935 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.477696896 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.491564989 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.491571903 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.491887093 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.491889954 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648263931 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648293018 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648349047 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648359060 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648462057 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648529053 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648529053 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648552895 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648554087 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.648719072 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.649938107 CEST61549443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.649945021 CEST4436154913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.649985075 CEST61547443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.651000023 CEST61551443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.651031971 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.651212931 CEST61547443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.651212931 CEST61547443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.651262045 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.651289940 CEST4436154713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.652792931 CEST61552443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.652852058 CEST61551443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.652858019 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.653003931 CEST61551443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.653013945 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.653039932 CEST61552443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.653290033 CEST61552443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.653321028 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.741375923 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.741898060 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.741959095 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.741991997 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742008924 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742021084 CEST61546443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742028952 CEST4436154613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742125034 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742276907 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742563009 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742820978 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742820978 CEST61548443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742842913 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.742855072 CEST4436154813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744252920 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744256020 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744330883 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744368076 CEST61554443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744395971 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744422913 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744426012 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744539976 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744564056 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744592905 CEST61554443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744605064 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744882107 CEST61554443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744904995 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744932890 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744942904 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744972944 CEST61550443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.744976997 CEST4436155013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.746721029 CEST61555443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.746759892 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.746884108 CEST61555443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.746992111 CEST61555443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:41.747020006 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.291702032 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.292103052 CEST61551443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.292125940 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.292515993 CEST61551443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.292524099 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.321397066 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.321795940 CEST61552443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.321830034 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.322155952 CEST61552443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.322169065 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.377355099 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.377717018 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.377767086 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.378470898 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.378489017 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.391222000 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.391653061 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.391720057 CEST61551443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.391757011 CEST61551443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.391757011 CEST61551443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.391777039 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.391788006 CEST4436155113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.393805981 CEST61556443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.393831968 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.393995047 CEST61556443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.394114971 CEST61556443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.394119024 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.414457083 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.414777040 CEST61555443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.414813042 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.415110111 CEST61555443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.415121078 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.422097921 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.427933931 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428107023 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428107023 CEST61554443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428133011 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428443909 CEST61554443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428455114 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428494930 CEST61552443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428647995 CEST61552443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428647995 CEST61552443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428678036 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.428702116 CEST4436155213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.430775881 CEST61557443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.430860043 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.434940100 CEST61557443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.435249090 CEST61557443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.435281992 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.478883028 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.478912115 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.478962898 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.478988886 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.479027987 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.479186058 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.479186058 CEST61553443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.479219913 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.479243994 CEST4436155313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.482270002 CEST61558443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.482299089 CEST4436155813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.482537985 CEST61558443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.482646942 CEST61558443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.482661963 CEST4436155813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.523134947 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.523359060 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.523551941 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.523629904 CEST61555443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.523629904 CEST61555443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.523677111 CEST61555443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.523698092 CEST4436155513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.525502920 CEST61559443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.525533915 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.525738001 CEST61559443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.525882959 CEST61559443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.525896072 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.532646894 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.532927990 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.533138037 CEST61554443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.533173084 CEST61554443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.533174038 CEST61554443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.533191919 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.533211946 CEST4436155413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.534879923 CEST61560443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.534914017 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.534995079 CEST61560443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.535100937 CEST61560443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:42.535115004 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.043818951 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.045075893 CEST61556443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.045088053 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.045499086 CEST61556443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.045504093 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.128357887 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.128909111 CEST61557443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.128963947 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.129333973 CEST61557443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.129348040 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.170331001 CEST4436155813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.170672894 CEST61558443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.170687914 CEST4436155813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.171041965 CEST61558443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.171052933 CEST4436155813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.184827089 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.184895039 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.185273886 CEST61556443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.185836077 CEST61556443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.185854912 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.185863972 CEST61556443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.185868979 CEST4436155613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.186290979 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.187155962 CEST61560443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.187175989 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.187486887 CEST61560443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.187494040 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.188544035 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.188591003 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.188688993 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.188807011 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.188815117 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.193123102 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.193397045 CEST61559443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.193404913 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.193718910 CEST61559443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.193723917 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.233632088 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.233691931 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.233922958 CEST61557443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.233967066 CEST61557443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.234002113 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.234028101 CEST61557443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.234042883 CEST4436155713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.235800982 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.235819101 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.235908985 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.236004114 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.236013889 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.275528908 CEST4436155813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.275605917 CEST4436155813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.275986910 CEST61558443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.275986910 CEST61558443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.276026011 CEST61558443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.276041031 CEST4436155813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.278038025 CEST61563443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.278069973 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.278377056 CEST61563443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.278701067 CEST61563443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.278714895 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.287378073 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.287897110 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.287960052 CEST61560443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.287978888 CEST61560443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.287988901 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.288002014 CEST61560443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.288009882 CEST4436156013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.289603949 CEST61564443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.289628029 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.289757967 CEST61564443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.289874077 CEST61564443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.289880037 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.295511961 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.296613932 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.296715021 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.297174931 CEST61559443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.297261000 CEST61559443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.297269106 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.297276974 CEST61559443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.297286987 CEST4436155913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.299182892 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.299271107 CEST4436156513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.299436092 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.299557924 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.299592018 CEST4436156513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.845416069 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.877633095 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.899307966 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.919420958 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.933588028 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.933758974 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.970630884 CEST61564443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.970647097 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.971020937 CEST61564443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.971024990 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.971193075 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.971200943 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.971477985 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.971483946 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.975569963 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.975575924 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.978344917 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.978348970 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.979588985 CEST61563443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.979609013 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.980125904 CEST61563443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:43.980134010 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.066586971 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.066747904 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.066806078 CEST61564443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.066833019 CEST61564443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.066843987 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.066864014 CEST61564443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.066869974 CEST4436156413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068341970 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068587065 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068630934 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068662882 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068681002 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068825006 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068845987 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068859100 CEST61561443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.068866968 CEST4436156113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.070142984 CEST61566443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.070219994 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.070493937 CEST61566443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.070780993 CEST61566443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.070816994 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.071049929 CEST61567443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.071072102 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.071134090 CEST61567443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.071249008 CEST61567443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.071259975 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.073937893 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.074007988 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.074434042 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.074646950 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.074646950 CEST61562443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.074656010 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.074666977 CEST4436156213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.075795889 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.076128960 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.076678038 CEST61568443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.076747894 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.076910019 CEST61568443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.076915026 CEST61563443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.077140093 CEST61563443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.077140093 CEST61563443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.077157021 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.077167034 CEST4436156313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.078098059 CEST61568443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.078131914 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.079241991 CEST61569443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.079271078 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.079427958 CEST61569443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.079606056 CEST61569443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.079619884 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.656595945 CEST4436156513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.657171965 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.657264948 CEST4436156513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.657476902 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.657497883 CEST4436156513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.700103998 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.700413942 CEST61569443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.700431108 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.700766087 CEST61569443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.700769901 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.759746075 CEST4436156513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.759901047 CEST4436156513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.760097027 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.760097980 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.760097980 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.762283087 CEST61570443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.762314081 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.762541056 CEST61570443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.762644053 CEST61570443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.762649059 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.786907911 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.787117958 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.789591074 CEST61568443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.789607048 CEST61566443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.789633989 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.789669991 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.789848089 CEST61566443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.789863110 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.789925098 CEST61568443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.789938927 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.798896074 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.799194098 CEST61567443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.799212933 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.799516916 CEST61567443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.799520969 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.801187992 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.801207066 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.801245928 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.802436113 CEST61569443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.802562952 CEST61569443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.802573919 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.802582979 CEST61569443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.802586079 CEST4436156913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.804728985 CEST61571443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.804780960 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.804862022 CEST61571443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.804991961 CEST61571443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.805006027 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.894690037 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.894874096 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.894926071 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.895037889 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.895131111 CEST61566443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.895222902 CEST61566443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.895222902 CEST61566443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.895270109 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.895301104 CEST4436156613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.896106958 CEST61568443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.896250963 CEST61568443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.896280050 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.896306992 CEST61568443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.896322012 CEST4436156813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898433924 CEST61572443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898510933 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898520947 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898597956 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898650885 CEST61572443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898688078 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898772001 CEST61572443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898792982 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898938894 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.898977995 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.906301022 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.906740904 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.906934023 CEST61567443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.906958103 CEST61567443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.906970978 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.906980991 CEST61567443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.906985044 CEST4436156713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.909132957 CEST61574443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.909153938 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.909308910 CEST61574443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.909356117 CEST61574443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:44.909365892 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.075633049 CEST61565443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.075697899 CEST4436156513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.440634966 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.441241980 CEST61570443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.441258907 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.441907883 CEST61570443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.441912889 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.459491968 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.464194059 CEST61571443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.464238882 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.464793921 CEST61571443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.464807987 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.537935972 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.538559914 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.538636923 CEST61570443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.538677931 CEST61570443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.538688898 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.538696051 CEST61570443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.538700104 CEST4436157013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.540313005 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.541166067 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.541228056 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.541558027 CEST61575443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.541646957 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.541723967 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.541737080 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.541805029 CEST61575443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.542009115 CEST61575443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.542026997 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.560013056 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.560065031 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.566001892 CEST61571443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.566343069 CEST61571443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.566343069 CEST61571443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.566380978 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.566405058 CEST4436157113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.573399067 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.573941946 CEST61576443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.574032068 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.574080944 CEST61574443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.574086905 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.574162006 CEST61576443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.574357033 CEST61576443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.574395895 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.574706078 CEST61574443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.574711084 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.591656923 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.592062950 CEST61572443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.592111111 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.592590094 CEST61572443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.592602015 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640326977 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640347004 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640423059 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640444040 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640564919 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640642881 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640712023 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640743971 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640769958 CEST61573443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.640784979 CEST4436157313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.643296003 CEST61577443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.643327951 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.644440889 CEST61577443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.644577026 CEST61577443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.644583941 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.695528030 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.695599079 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.695705891 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.695859909 CEST61574443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.696244955 CEST61574443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.696248055 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.696257114 CEST61574443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.696259975 CEST4436157413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.698885918 CEST61578443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.698915005 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.700875998 CEST61578443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.701158047 CEST61578443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.701173067 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.702416897 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.703032970 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.704025030 CEST61572443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.704076052 CEST61572443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.704076052 CEST61572443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.704107046 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.704128981 CEST4436157213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.706013918 CEST61579443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.706100941 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.706191063 CEST61579443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.706305981 CEST61579443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.706342936 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.712616920 CEST49750443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.712629080 CEST4434975023.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.712697029 CEST49750443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.712702990 CEST4434975023.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.713020086 CEST61580443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.713064909 CEST4436158023.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.730448008 CEST61580443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.730745077 CEST61580443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.730860949 CEST4436158023.1.237.91192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.732326031 CEST61580443192.168.2.523.1.237.91
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.028100967 CEST61581443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.028187037 CEST4436158134.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.028506041 CEST61581443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.029830933 CEST61581443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.029871941 CEST4436158134.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.243056059 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.244349957 CEST61576443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.244434118 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.244905949 CEST61576443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.244920969 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.299702883 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.300173044 CEST61577443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.300192118 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.300621986 CEST61577443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.300630093 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.342413902 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.342854023 CEST61578443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.342885971 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.343450069 CEST61578443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.343458891 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.348305941 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.348807096 CEST61579443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.348867893 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.349121094 CEST61579443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.349137068 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.385848045 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.385899067 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.386081934 CEST61576443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.386174917 CEST61576443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.386220932 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.386255026 CEST61576443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.386271954 CEST4436157613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.390877962 CEST61582443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.390912056 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.391213894 CEST61582443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.391314983 CEST61582443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.391324997 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.398911953 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.398964882 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.399019003 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.399137974 CEST61577443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.399358988 CEST61577443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.399375916 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.399396896 CEST61577443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.399404049 CEST4436157713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.401854992 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.401875019 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.401948929 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.402070999 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.402082920 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.441759109 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.441916943 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.442011118 CEST61578443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.442039967 CEST61578443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.442054987 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.442066908 CEST61578443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.442073107 CEST4436157813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.444196939 CEST61584443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.444226980 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.444293022 CEST61584443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.444377899 CEST61584443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.444387913 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.445971966 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.446022034 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.446141005 CEST61579443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.446206093 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.446320057 CEST61579443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.446320057 CEST61579443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.446342945 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.446587086 CEST4436157913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.448352098 CEST61585443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.448435068 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.448529005 CEST61585443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.448628902 CEST61585443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.448651075 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.503567934 CEST4436158134.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.503782034 CEST61581443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.508373022 CEST61581443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.508404016 CEST4436158134.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.508501053 CEST61581443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.508697033 CEST4436158134.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.508805037 CEST61581443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.511759043 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.516648054 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.608222961 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.612302065 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.617588997 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.653408051 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.668700933 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.670523882 CEST61575443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.670563936 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.671189070 CEST61575443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.671201944 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.721196890 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.762675047 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.768830061 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.769021988 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.769073963 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.769372940 CEST61575443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.769467115 CEST61575443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.769467115 CEST61575443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.769498110 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.769521952 CEST4436157513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.772984028 CEST61586443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.773030043 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.773164034 CEST61586443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.773391008 CEST61586443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.773416996 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.060302973 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.068608046 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.073421955 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.073442936 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.073858976 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.073863029 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.074146032 CEST61582443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.074167967 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.074686050 CEST61582443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.074691057 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.091782093 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.092125893 CEST61585443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.092180014 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.092655897 CEST61585443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.092669964 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.094209909 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.094886065 CEST61584443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.094913960 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.095406055 CEST61584443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.095412016 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.169699907 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.169733047 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.169795036 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.169832945 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.169913054 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.170135021 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.170144081 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.170159101 CEST61583443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.170162916 CEST4436158313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.173254013 CEST61587443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.173284054 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174133062 CEST61587443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174269915 CEST61587443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174276114 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174488068 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174505949 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174532890 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174669027 CEST61582443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174837112 CEST61582443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174854994 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174865961 CEST61582443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.174870968 CEST4436158213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.177484989 CEST61588443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.177506924 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.177612066 CEST61588443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.177798986 CEST61588443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.177810907 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.191992998 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.192157984 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.192271948 CEST61585443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.192338943 CEST61585443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.192338943 CEST61585443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.192375898 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.192399025 CEST4436158513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.194705009 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.194848061 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.194945097 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195065975 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195089102 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195198059 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195228100 CEST61584443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195230961 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195254087 CEST61584443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195254087 CEST61584443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195266008 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.195276022 CEST4436158413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.197402954 CEST61590443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.197427988 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.198209047 CEST61590443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.201185942 CEST61590443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:47.201209068 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.040417910 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.040724993 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.041019917 CEST61588443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.041038036 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.041376114 CEST61587443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.041436911 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.041521072 CEST61588443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.041527987 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.041955948 CEST61587443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.041970015 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.042937994 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.043282032 CEST61590443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.043339968 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.043786049 CEST61590443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.043798923 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.046713114 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.047060013 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.047074080 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.047580004 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.047590017 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.053289890 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.053626060 CEST61586443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.053689003 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.053977966 CEST61586443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.053991079 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.140501976 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.140912056 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.143604040 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.143759966 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.145777941 CEST61590443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.145858049 CEST61588443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.145971060 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.145979881 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.146791935 CEST61588443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.146791935 CEST61588443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.146814108 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.146826029 CEST4436158813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.147049904 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.147099972 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.147118092 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.147222996 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.147793055 CEST61587443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.147943974 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.147944927 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.147944927 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.148473978 CEST61590443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.148504972 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.148545980 CEST61590443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.148560047 CEST4436159013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.149432898 CEST61587443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.149463892 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.149511099 CEST61587443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.149525881 CEST4436158713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.151948929 CEST61591443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.151972055 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.152358055 CEST61591443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153049946 CEST61592443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153084993 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153511047 CEST61593443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153532028 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153775930 CEST61591443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153794050 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153879881 CEST61592443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153912067 CEST61593443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153932095 CEST61592443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.153939962 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.154457092 CEST61594443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.154467106 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.154550076 CEST61593443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.154566050 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.154597044 CEST61594443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.154687881 CEST61594443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.154695034 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.158112049 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.158493042 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.158603907 CEST61586443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.158750057 CEST61586443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.158790112 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.158818007 CEST61586443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.158833027 CEST4436158613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.160618067 CEST61595443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.160628080 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.160823107 CEST61595443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.160823107 CEST61595443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.160845995 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.459830999 CEST61589443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.459886074 CEST4436158913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.792284012 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.792831898 CEST61594443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.792844057 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.793319941 CEST61594443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.793323040 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.801398993 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.801742077 CEST61592443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.801755905 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.802139997 CEST61592443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.802144051 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.838032961 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.838711023 CEST61593443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.838718891 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.839179039 CEST61593443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.839184046 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.842962027 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.843311071 CEST61595443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.843327999 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.843674898 CEST61595443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.843678951 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.893196106 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.893253088 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.893313885 CEST61594443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.893523932 CEST61594443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.893532991 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.893556118 CEST61594443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.893560886 CEST4436159413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.896079063 CEST61596443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.896130085 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.896212101 CEST61596443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.896378994 CEST61596443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.896384001 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.902563095 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.902589083 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.902646065 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.904297113 CEST61592443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.904598951 CEST61592443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.904619932 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.904629946 CEST61592443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.904633999 CEST4436159213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.906785011 CEST61597443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.906873941 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.907133102 CEST61597443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.907278061 CEST61597443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.907316923 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.942095995 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.942260981 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.942492008 CEST61593443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.942653894 CEST61593443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.942662954 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.942684889 CEST61593443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.942689896 CEST4436159313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.943495035 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.944243908 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.944420099 CEST61595443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.944571018 CEST61595443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.944580078 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.944587946 CEST61595443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.944592953 CEST4436159513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.944901943 CEST61598443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.944989920 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.945565939 CEST61598443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.945708990 CEST61598443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.945744038 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.946650982 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.946682930 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.946842909 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.947134972 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:48.947146893 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.571329117 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.571824074 CEST61596443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.571860075 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.572244883 CEST61596443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.572249889 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.606626987 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.607150078 CEST61597443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.607242107 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.608280897 CEST61597443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.608298063 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.612715960 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.612984896 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.613075018 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.613090992 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.613517046 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.613521099 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.613682032 CEST61598443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.613698006 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.614198923 CEST61598443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.614211082 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.685868025 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.685920954 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.685978889 CEST61596443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.686127901 CEST61596443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.686146021 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.686161995 CEST61596443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.686167002 CEST4436159613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.688946962 CEST61600443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.688967943 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.689122915 CEST61600443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.689310074 CEST61600443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.689315081 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.714476109 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.716209888 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.716284990 CEST61598443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.716376066 CEST61598443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.716376066 CEST61598443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.716423988 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.716451883 CEST4436159813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.718614101 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.718664885 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.718836069 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.718970060 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719002962 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719357014 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719382048 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719432116 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719446898 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719582081 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719594002 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719604015 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719609976 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719969988 CEST61599443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.719974041 CEST4436159913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.721623898 CEST61602443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.721645117 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.721725941 CEST61602443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.721873045 CEST61602443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.721899033 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.728460073 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.728487968 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.728523016 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.728652954 CEST61597443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.728714943 CEST61597443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.728728056 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.728773117 CEST61597443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.728785038 CEST4436159713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.730982065 CEST61603443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.731003046 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.731090069 CEST61603443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.731239080 CEST61603443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:49.731245995 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.325848103 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.326311111 CEST61600443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.326329947 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.326725006 CEST61600443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.326730967 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.356723070 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.357244968 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.357311010 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.357517958 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.357534885 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.410943985 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.411401033 CEST61603443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.411415100 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.411739111 CEST61603443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.411744118 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.415136099 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.415657997 CEST61602443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.415721893 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.415946007 CEST61602443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.415961981 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.426342964 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.426769972 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.426831007 CEST61600443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.426856995 CEST61600443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.426856995 CEST61600443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.426872969 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.426881075 CEST4436160013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.429152966 CEST61604443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.429188967 CEST4436160413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.429287910 CEST61604443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.429404020 CEST61604443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.429411888 CEST4436160413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.456932068 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.456954002 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.456994057 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.457139969 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.457139969 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.457139969 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.457245111 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.457566023 CEST61601443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.457586050 CEST4436160113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.458888054 CEST61605443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.458916903 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.459153891 CEST61605443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.459260941 CEST61605443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.459273100 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.516247988 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.516381025 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.516415119 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.516521931 CEST61603443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.516544104 CEST61603443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.516544104 CEST61603443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.516554117 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.516561985 CEST4436160313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.518349886 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.518358946 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.518451929 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.518565893 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.518574953 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.521073103 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.521230936 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.521450996 CEST61602443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.521532059 CEST61602443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.521532059 CEST61602443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.521574020 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.521600962 CEST4436160213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.523076057 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.523092985 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.523168087 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.523272991 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:50.523283005 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.315541029 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.315951109 CEST61605443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.315968037 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.316363096 CEST61605443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.316368103 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.321397066 CEST4436160413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.321686983 CEST61604443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.321701050 CEST4436160413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.322035074 CEST61604443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.322042942 CEST4436160413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.323601007 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.323858976 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.323864937 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.324095964 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.324158907 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.324163914 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.324556112 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.324578047 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.324855089 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.324860096 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.414881945 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.414907932 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.414959908 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.415121078 CEST61605443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.415121078 CEST61605443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.415299892 CEST61605443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.415314913 CEST4436160513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.417440891 CEST61608443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.417478085 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.417679071 CEST61608443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.417787075 CEST61608443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.417793036 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423444033 CEST4436160413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423491955 CEST4436160413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423629999 CEST61604443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423629999 CEST61604443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423651934 CEST61604443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423662901 CEST4436160413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423813105 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423852921 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.423928022 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.424036980 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.424299955 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.424422026 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.424422026 CEST61607443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.424427032 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.424433947 CEST4436160713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.425497055 CEST61609443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.425563097 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.425708055 CEST61609443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.425839901 CEST61609443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.425858021 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.426395893 CEST61610443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.426420927 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.426493883 CEST61610443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.426580906 CEST61610443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.426606894 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427372932 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427402973 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427489996 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427503109 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427620888 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427637100 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427637100 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427650928 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427659988 CEST61606443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.427664995 CEST4436160613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.429204941 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.429218054 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.429421902 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.429529905 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.429543972 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.601906061 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.602324009 CEST61591443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.602334976 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.602699995 CEST61591443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:51.602705956 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.611542940 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.611594915 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.612134933 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.612355947 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.612365007 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.707335949 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.707555056 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.707619905 CEST61591443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.707654953 CEST61591443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.707654953 CEST61591443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.707669973 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.707680941 CEST4436159113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.709960938 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.710036039 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.710221052 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.710336924 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.710357904 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.902986050 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.903696060 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.903714895 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.904068947 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.904347897 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.904355049 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.904665947 CEST61610443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.904726028 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.905181885 CEST61610443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.905200005 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.906352997 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.906757116 CEST61609443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.906784058 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.907074928 CEST61609443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.907087088 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.912796974 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.913429976 CEST61608443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.913446903 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.913954973 CEST61608443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:52.913960934 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.006414890 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.006879091 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.006944895 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.006957054 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.007031918 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.007102013 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.007117987 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.007133007 CEST61611443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.007148027 CEST4436161113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.010328054 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.010418892 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.010519981 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.010667086 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.010689974 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.054297924 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.054339886 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.055042028 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.055114985 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.055221081 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.059437990 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.060235023 CEST61609443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.060440063 CEST61610443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.070651054 CEST61610443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.070703030 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.070811987 CEST61610443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.070830107 CEST4436161013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.072643042 CEST61609443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.072664022 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.072686911 CEST61609443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.072699070 CEST4436160913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.077369928 CEST61615443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.077461004 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.078118086 CEST61616443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.078144073 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.083034039 CEST61616443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.083043098 CEST61615443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.083630085 CEST61615443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.083663940 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.083703041 CEST61616443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.083715916 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.100363016 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.100454092 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.107048035 CEST61608443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.107208014 CEST61608443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.107227087 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.107239962 CEST61608443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.107248068 CEST4436160813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.110457897 CEST61617443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.110496998 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.110635042 CEST61617443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.110825062 CEST61617443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.110846043 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.353432894 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.361514091 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.361557007 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.362837076 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.380455971 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.380614042 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.380624056 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.380641937 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.380680084 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.428878069 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.439707994 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.489605904 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.524389982 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.524420977 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.524918079 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.524930000 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.599803925 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.599837065 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.601406097 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.601814032 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.601841927 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.624397039 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.625159025 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.625260115 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.625319958 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.625319958 CEST61613443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.625354052 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.625376940 CEST4436161313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.628982067 CEST61619443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.629013062 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.629189014 CEST61619443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.629553080 CEST61619443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.629569054 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.655818939 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.656162024 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.657006025 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.657756090 CEST61612443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.657772064 CEST44361612142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.670629025 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.671116114 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.671137094 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.671600103 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.671610117 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.749823093 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.750375986 CEST61615443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.750435114 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.750827074 CEST61615443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.750839949 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.754317045 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.754709959 CEST61616443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.754724026 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.755029917 CEST61616443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.755034924 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771625996 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771656036 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771708012 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771733046 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771838903 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771883965 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771914005 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771939993 CEST61614443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.771954060 CEST4436161413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.774858952 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.774893045 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.775343895 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.775497913 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.775506973 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.786304951 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.786665916 CEST61617443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.786679983 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.787214994 CEST61617443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.787220001 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.851929903 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.852133989 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.852166891 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.852314949 CEST61615443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.852413893 CEST61615443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.852413893 CEST61615443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.852444887 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.852468967 CEST4436161513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.855638981 CEST61622443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.855683088 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.855777025 CEST61622443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.855890036 CEST61622443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.855897903 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.862178087 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.862818003 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.862904072 CEST61616443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.862929106 CEST61616443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.862940073 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.862950087 CEST61616443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.862955093 CEST4436161613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.866055965 CEST61623443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.866142035 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.866247892 CEST61623443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.866449118 CEST61623443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.866486073 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.888905048 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.889153957 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.889231920 CEST61617443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.889256954 CEST61617443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.889256954 CEST61617443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.889285088 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.889292955 CEST4436161713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.891592979 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.891655922 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.892586946 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.892683029 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:53.892699957 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.237889051 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.238260984 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.238270044 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.238778114 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.239608049 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.239689112 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.239759922 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.239773035 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.239789963 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.273024082 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.273591995 CEST61619443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.273611069 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.274024010 CEST61619443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.274029016 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.292151928 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.348292112 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.353173018 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.372158051 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.373271942 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.373354912 CEST61619443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.373387098 CEST61619443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.373394012 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.373402119 CEST61619443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.373405933 CEST4436161913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.376247883 CEST61625443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.376288891 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.376383066 CEST61625443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.376519918 CEST61625443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.376535892 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.437215090 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.437633038 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.437645912 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.438069105 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.438074112 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.445970058 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.449265003 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.454273939 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.454547882 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.455426931 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.455599070 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.455719948 CEST61618443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.455729961 CEST44361618142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.492734909 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.502099991 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.506325960 CEST61622443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.506344080 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.506661892 CEST61622443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.506666899 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.529002905 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.529654026 CEST61623443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.529741049 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.529968977 CEST61623443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.529984951 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.533210993 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.533242941 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.533485889 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.533688068 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.533696890 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.539913893 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540023088 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540070057 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540080070 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540096045 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540144920 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540204048 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540215015 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540224075 CEST61621443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.540227890 CEST4436162113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.542898893 CEST61627443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.542936087 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.543008089 CEST61627443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.543132067 CEST61627443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.543145895 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.547792912 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.593209982 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.604044914 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.604362011 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.604451895 CEST61622443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.604649067 CEST61622443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.604662895 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.604671955 CEST61622443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.604676008 CEST4436162213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.607369900 CEST61628443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.607456923 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.608714104 CEST61628443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.609791994 CEST61628443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.609827042 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.631133080 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.631369114 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.639417887 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.646688938 CEST61623443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.646927118 CEST61623443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.646927118 CEST61623443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.646972895 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.647003889 CEST4436162313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.649059057 CEST61629443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.649079084 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.649624109 CEST61629443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.649753094 CEST61629443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.649765015 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.024748087 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.025970936 CEST61625443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.025995970 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.026436090 CEST61625443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.026448965 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.041882038 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.041915894 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.042150974 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.042460918 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.042470932 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.061827898 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.062220097 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.062232971 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.062635899 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.062640905 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.123034954 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.123224020 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.123370886 CEST61625443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.123684883 CEST61625443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.123684883 CEST61625443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.123727083 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.123754025 CEST4436162513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.126822948 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.126903057 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.127119064 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.127301931 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.127336025 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.161680937 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.161772966 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.161881924 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.161915064 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.161956072 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.161995888 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.161995888 CEST61624443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.162026882 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.162050962 CEST4436162413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.164150953 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.164196968 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.164436102 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.164544106 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.164558887 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.179101944 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.181303978 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.181320906 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.181850910 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.186223984 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.186326981 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.186378956 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.186417103 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.186422110 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.193631887 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.194165945 CEST61628443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.194207907 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.194617033 CEST61628443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.194631100 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.224214077 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.224633932 CEST61627443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.224652052 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.225042105 CEST61627443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.225045919 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.237755060 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.297230005 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.297646046 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.297800064 CEST61628443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.297877073 CEST61628443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.297877073 CEST61628443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.297919989 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.297949076 CEST4436162813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.300693035 CEST61633443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.300760031 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.300959110 CEST61633443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.301069975 CEST61633443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.301085949 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.305260897 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.305603027 CEST61629443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.305613041 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.305974960 CEST61629443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.305979013 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.332721949 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.332958937 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.332990885 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.333117008 CEST61627443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.333250046 CEST61627443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.333250046 CEST61627443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.333282948 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.333307981 CEST4436162713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.335289955 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.335335016 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.335431099 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.335536957 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.335570097 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.404966116 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.405586958 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.405661106 CEST61629443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.405680895 CEST61629443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.405692101 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.405700922 CEST61629443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.405705929 CEST4436162913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.407846928 CEST61635443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.407875061 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.407969952 CEST61635443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.408097029 CEST61635443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.408103943 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.481184959 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.484592915 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.484656096 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.484972954 CEST61626443192.168.2.5142.250.186.142
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.484987974 CEST44361626142.250.186.142192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.835483074 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.874902010 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.875636101 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.890480042 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.970716953 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.992480040 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.992494106 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.992916107 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.992919922 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.994237900 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.994257927 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.995292902 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.996581078 CEST61633443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.996629953 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.996944904 CEST61633443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:55.996958017 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.022670031 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.024957895 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.029606104 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.029619932 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.030332088 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.030342102 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.071398020 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.075997114 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.076308012 CEST61635443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.076318026 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.076642036 CEST61635443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.076644897 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.090255976 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.090447903 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.090528011 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.090553999 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.090565920 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.090574980 CEST61632443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.090579033 CEST4436163213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093066931 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093157053 CEST61636443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093240976 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093319893 CEST61636443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093391895 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093437910 CEST61636443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093456030 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093470097 CEST61633443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093518972 CEST61633443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093545914 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093590021 CEST61633443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.093604088 CEST4436163313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.095288038 CEST61637443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.095305920 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.095416069 CEST61637443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.095558882 CEST61637443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.095570087 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127449989 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127616882 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127651930 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127671003 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127702951 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127727032 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127737999 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127785921 CEST61634443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.127798080 CEST4436163413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.129545927 CEST61638443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.129563093 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.129710913 CEST61638443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.129805088 CEST61638443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.129826069 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.134721994 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.135024071 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.135066032 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.135349989 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.135363102 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.172703028 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.173235893 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.173491001 CEST61635443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.173516989 CEST61635443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.173516989 CEST61635443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.173528910 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.173536062 CEST4436163513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.176013947 CEST61639443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.176069975 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.176153898 CEST61639443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.176301956 CEST61639443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.176330090 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.234772921 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.234852076 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.234925032 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.234978914 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.235079050 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.235137939 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.235184908 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.235214949 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.235230923 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.235853910 CEST61631443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.235868931 CEST4436163113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.237782955 CEST61640443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.237812042 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.237884998 CEST61640443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.238020897 CEST61640443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.238028049 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.292970896 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.293004036 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.293018103 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.293034077 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.293082952 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.293106079 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.293117046 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.293155909 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.294329882 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.294375896 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.294560909 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.295110941 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.295126915 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.296474934 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.296488047 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.296705961 CEST61630443192.168.2.54.175.87.197
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.296710968 CEST443616304.175.87.197192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.741079092 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.741668940 CEST61636443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.741715908 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.742156982 CEST61636443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.742172003 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.782802105 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.783246994 CEST61637443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.783258915 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.783642054 CEST61637443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.783646107 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.824662924 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.825103045 CEST61639443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.825139999 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.825500011 CEST61639443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.825515985 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.845020056 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.845046043 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.845087051 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.845262051 CEST61636443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.845803976 CEST61636443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.845803976 CEST61636443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.845839977 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.845865011 CEST4436163613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.849797964 CEST61641443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.849831104 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.850001097 CEST61641443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.850199938 CEST61641443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.850210905 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.888247013 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.888326883 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.888413906 CEST61637443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.888659000 CEST61637443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.888673067 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.888678074 CEST61637443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.888683081 CEST4436163713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.891870975 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.891891003 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.892045021 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.892313957 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.892323971 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.899970055 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.900414944 CEST61640443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.900434017 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.901823997 CEST61640443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.901829958 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.934950113 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.935252905 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.935540915 CEST61639443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.935718060 CEST61639443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.935718060 CEST61639443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.935740948 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.935761929 CEST4436163913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.942533970 CEST61643443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.942562103 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.942763090 CEST61643443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.942924023 CEST61643443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:56.942929983 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.029210091 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.029268026 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.029367924 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.029470921 CEST61640443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.029501915 CEST61640443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.029501915 CEST61640443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.029515028 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.029525995 CEST4436164013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.031986952 CEST61644443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.032083035 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.032352924 CEST61644443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.032460928 CEST61644443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.032481909 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.497354031 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.497937918 CEST61641443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.497982025 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.498199940 CEST61641443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.498210907 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.524986029 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.526046991 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.526046991 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.526082039 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.526104927 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.596877098 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.597286940 CEST61643443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.597310066 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.597490072 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.597637892 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.597821951 CEST61643443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.597827911 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.597902060 CEST61641443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.598157883 CEST61641443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.598172903 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.598192930 CEST61641443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.598200083 CEST4436164113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.601947069 CEST61645443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.601978064 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.603020906 CEST61645443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.603171110 CEST61645443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.603178024 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.623768091 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.624372959 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.624430895 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.624485970 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.624636889 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.624636889 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.624636889 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.626774073 CEST61646443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.626782894 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.626924992 CEST61646443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.627001047 CEST61646443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.627006054 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.685045958 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.685527086 CEST61644443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.685616016 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.685884953 CEST61644443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.685899973 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.696541071 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.697247982 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.697325945 CEST61643443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.697361946 CEST61643443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.697377920 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.697412014 CEST61643443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.697418928 CEST4436164313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.699934006 CEST61647443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.699991941 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.700077057 CEST61647443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.700215101 CEST61647443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.700249910 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.787771940 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.787802935 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.787849903 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.788007021 CEST61644443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.788007021 CEST61644443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.788089991 CEST61644443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.788130045 CEST4436164413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.790600061 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.790621996 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.790930033 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.790930033 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.790954113 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.932868958 CEST61642443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:57.932887077 CEST4436164213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.255630016 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.257786989 CEST61645443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.257803917 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.258414030 CEST61645443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.258418083 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.275537968 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.276489973 CEST61646443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.276498079 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.277045965 CEST61646443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.277050972 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.358561993 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.358681917 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.360496044 CEST61645443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.369895935 CEST61645443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.369911909 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.369924068 CEST61645443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.369927883 CEST4436164513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.375988007 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.376713037 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.376833916 CEST61646443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.378413916 CEST61649443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.378457069 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.379075050 CEST61646443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.379081964 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.379095078 CEST61646443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.379097939 CEST4436164613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.380110979 CEST61649443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.381072044 CEST61649443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.381089926 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.383563995 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.395344019 CEST61647443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.395426035 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.399660110 CEST61647443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.399674892 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.457995892 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.502427101 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.502580881 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.511425972 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.519170046 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.519181013 CEST61647443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.550389051 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.550395966 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.550964117 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.550967932 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.551636934 CEST61647443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.551636934 CEST61647443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.551712990 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.551748991 CEST4436164713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.571679115 CEST61650443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.571719885 CEST4436165013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.571831942 CEST61650443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.571938038 CEST61650443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.571954012 CEST4436165013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.574007988 CEST61651443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.574034929 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.574445963 CEST61651443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.574764013 CEST61651443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.574775934 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.651484966 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.651575089 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.651681900 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.651695967 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.651760101 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.651999950 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.652020931 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.652033091 CEST61648443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.652038097 CEST4436164813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.656460047 CEST61652443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.656512022 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.656676054 CEST61652443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.656801939 CEST61652443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:58.656821966 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.056201935 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.056679964 CEST61649443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.056727886 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.056996107 CEST61649443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.057008982 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.157130957 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.157576084 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.157646894 CEST61649443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.157700062 CEST61649443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.157700062 CEST61649443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.157736063 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.157758951 CEST4436164913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.160829067 CEST61653443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.160917044 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.161125898 CEST61653443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.161267042 CEST61653443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.161303043 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.241360903 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.241730928 CEST61651443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.241744995 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.242316961 CEST61651443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.242321014 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.259911060 CEST4436165013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.260413885 CEST61650443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.260452986 CEST4436165013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.260953903 CEST61650443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.260963917 CEST4436165013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.325134039 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.325464964 CEST61652443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.325500965 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.325992107 CEST61652443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.325999022 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.341146946 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.341213942 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.342358112 CEST61651443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.342617035 CEST61651443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.342632055 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.342642069 CEST61651443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.342648029 CEST4436165113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.345563889 CEST61654443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.345608950 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.345712900 CEST61654443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.345881939 CEST61654443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.345909119 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.361432076 CEST4436165013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.361756086 CEST4436165013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.365452051 CEST61650443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.365453005 CEST61650443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.366959095 CEST61650443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.366977930 CEST4436165013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.369923115 CEST61655443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.369973898 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.370064974 CEST61655443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.370237112 CEST61655443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.370254993 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.426137924 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.426198959 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.426296949 CEST61652443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.426453114 CEST61652443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.426466942 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.426481962 CEST61652443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.426489115 CEST4436165213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.429114103 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.429152966 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.429222107 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.429369926 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.429387093 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.907062054 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.907507896 CEST61653443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.907543898 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.907922029 CEST61653443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:59.907938004 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.028390884 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.029078960 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.029165983 CEST61653443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.029222012 CEST61653443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.029222012 CEST61653443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.029252052 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.029273987 CEST4436165313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.031672955 CEST61657443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.031754017 CEST4436165713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.031929970 CEST61657443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.032036066 CEST61657443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.032058001 CEST4436165713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.091130018 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.091939926 CEST61654443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.091958046 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.092328072 CEST61654443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.092339993 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.103339911 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.103656054 CEST61655443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.103697062 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.103878975 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.103988886 CEST61655443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.103996992 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.104207993 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.104228020 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.104494095 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.104499102 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.189838886 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.190032959 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.190102100 CEST61654443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.190139055 CEST61654443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.190151930 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.190191031 CEST61654443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.190206051 CEST4436165413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.192518950 CEST61658443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.192610025 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.193094969 CEST61658443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.193242073 CEST61658443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.193281889 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.208600998 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.208915949 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.209027052 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.209048986 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.209151030 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.209228992 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.209247112 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.209258080 CEST61656443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.209261894 CEST4436165613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.210932970 CEST61659443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.210948944 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211205959 CEST61659443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211224079 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211309910 CEST61659443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211321115 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211363077 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211565971 CEST61655443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211592913 CEST61655443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211592913 CEST61655443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211607933 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.211617947 CEST4436165513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.213371992 CEST61660443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.213407993 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.213685036 CEST61660443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.213772058 CEST61660443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.213779926 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.682898045 CEST4436165713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.683444023 CEST61657443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.683511019 CEST4436165713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.683712959 CEST61657443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.683727980 CEST4436165713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.706296921 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.707345963 CEST61638443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.707360983 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.707581997 CEST61638443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.707588911 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.784184933 CEST4436165713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.784276962 CEST4436165713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.784710884 CEST61657443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.784710884 CEST61657443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.784929037 CEST61657443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.784977913 CEST4436165713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.787229061 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.787277937 CEST4436166113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.789381981 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.789482117 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.789499044 CEST4436166113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.829405069 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.830890894 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.830969095 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.839401960 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.840332031 CEST61638443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.859568119 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.862195969 CEST61658443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.862289906 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.863307953 CEST61658443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.863322973 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.863483906 CEST61638443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.863507986 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.863555908 CEST61638443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.863564968 CEST4436163813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.867109060 CEST61660443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.867124081 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.867691040 CEST61660443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.867697001 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.869817972 CEST61662443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.869860888 CEST4436166213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.871017933 CEST61662443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.871236086 CEST61662443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.871251106 CEST4436166213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.874533892 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.888633966 CEST61659443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.888649940 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.892055035 CEST61659443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.892060041 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.958565950 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.958789110 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.958837032 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.965657949 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.966259956 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.966367960 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.974801064 CEST61660443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.974917889 CEST61658443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.975035906 CEST61658443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.975035906 CEST61658443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.975080013 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.975109100 CEST4436165813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.975166082 CEST61660443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.975166082 CEST61660443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.975188017 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.975198030 CEST4436166013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.991086006 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.991518974 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.991944075 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.991970062 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.992001057 CEST61659443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.992058039 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.992722988 CEST61664443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.992732048 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.992844105 CEST61659443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.992861986 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.992873907 CEST61659443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.992881060 CEST4436165913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.993421078 CEST61664443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.993609905 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.993623018 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.994051933 CEST61664443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.994062901 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.995647907 CEST61665443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.995671034 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:00.997383118 CEST61665443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.010890961 CEST61665443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.010906935 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.423717976 CEST4436166113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.424334049 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.424385071 CEST4436166113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.424839020 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.424853086 CEST4436166113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.523766041 CEST4436166113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.524566889 CEST4436166113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.524811983 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.524811983 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.524811983 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.527730942 CEST61666443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.527760029 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.527955055 CEST61666443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.528356075 CEST61666443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.528373003 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.534982920 CEST4436166213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.535357952 CEST61662443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.535367012 CEST4436166213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.535824060 CEST61662443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.535830021 CEST4436166213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.641026020 CEST4436166213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.641119957 CEST4436166213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.641413927 CEST61662443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.641415119 CEST61662443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.641509056 CEST61662443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.641527891 CEST4436166213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.643687963 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.643740892 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.643865108 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.643989086 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.644006014 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.654877901 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.655276060 CEST61664443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.655289888 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.655723095 CEST61664443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.655730009 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.681790113 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.682118893 CEST61665443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.682135105 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.682451963 CEST61665443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.682457924 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.691967010 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.692302942 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.692322016 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.692626953 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.692631960 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.754463911 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.755980015 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.756061077 CEST61664443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.756122112 CEST61664443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.756139040 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.756150961 CEST61664443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.756156921 CEST4436166413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.757515907 CEST61661443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.757545948 CEST4436166113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.758888960 CEST61668443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.758915901 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.759015083 CEST61668443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.759150028 CEST61668443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.759160042 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.787175894 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.787241936 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.787377119 CEST61665443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.787417889 CEST61665443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.787417889 CEST61665443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.787430048 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.787440062 CEST4436166513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.789879084 CEST61669443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.789963007 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.790138006 CEST61669443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.790287018 CEST61669443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.790321112 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796519995 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796586037 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796700954 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796725035 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796761990 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796785116 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796794891 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796803951 CEST61663443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.796809912 CEST4436166313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.798748016 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.798770905 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.798852921 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.798968077 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:01.798994064 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.191433907 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.192023993 CEST61666443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.192099094 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.192487955 CEST61666443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.192502975 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.295315981 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.295367956 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.295571089 CEST61666443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.295595884 CEST61666443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.295608997 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.295622110 CEST61666443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.295629025 CEST4436166613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.298289061 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.298321962 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.298578024 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.298706055 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.298717022 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.305536985 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.306091070 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.306133032 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.306965113 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.306972980 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.406918049 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.406935930 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.407134056 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.407171011 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.407396078 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.407452106 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.407494068 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.407514095 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.407527924 CEST61667443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.407535076 CEST4436166713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.413767099 CEST61672443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.413839102 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.414196014 CEST61672443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.414334059 CEST61672443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.414355993 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.416059971 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.416445017 CEST61668443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.416460991 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.416850090 CEST61668443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.416853905 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.432780981 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.433176994 CEST61669443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.433250904 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.433440924 CEST61669443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.433459044 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.452272892 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.453614950 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.453632116 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.454035997 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.454046965 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.517657042 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.517812014 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.517918110 CEST61668443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.517941952 CEST61668443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.517941952 CEST61668443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.517951965 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.517957926 CEST4436166813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.520262957 CEST61673443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.520347118 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.520489931 CEST61673443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.520585060 CEST61673443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.520606995 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.534420013 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.534440994 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.534490108 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.534548998 CEST61669443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.534620047 CEST61669443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.534653902 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.534678936 CEST61669443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.534693956 CEST4436166913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.536540985 CEST61674443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.536562920 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.536633015 CEST61674443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.536725044 CEST61674443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.536736965 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.554836988 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.554888010 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.554953098 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.554971933 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.555012941 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.555094957 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.555128098 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.555129051 CEST61670443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.555145025 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.555164099 CEST4436167013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.556838989 CEST61675443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.556871891 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.556950092 CEST61675443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.557065010 CEST61675443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.557094097 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.958568096 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.959091902 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.959112883 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.959556103 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:02.959561110 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.073447943 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.080842018 CEST61672443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.080903053 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.081289053 CEST61672443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.081304073 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.134805918 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.134840012 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.135288954 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.135329008 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.135363102 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.135406971 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.135427952 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.135447979 CEST61671443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.135452986 CEST4436167113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.138164997 CEST61676443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.138206959 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.139997959 CEST61676443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.140235901 CEST61676443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.140268087 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.161902905 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.178255081 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.178759098 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.178778887 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.178822041 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.184602976 CEST61672443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.185172081 CEST61673443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.185192108 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.185606003 CEST61673443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.185611010 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.185956955 CEST61672443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.185997009 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.186026096 CEST61672443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.186042070 CEST4436167213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.187100887 CEST61674443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.187108040 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.187437057 CEST61674443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.187442064 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.189024925 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.189062119 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.189196110 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.189328909 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.189338923 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.222465038 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.226866961 CEST61675443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.226906061 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.227241039 CEST61675443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.227252960 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.283842087 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.284006119 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.285038948 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.285085917 CEST61673443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.285104990 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.297216892 CEST61674443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.324665070 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.324750900 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.330611944 CEST61675443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.334161997 CEST61673443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.334161997 CEST61673443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.334224939 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.334253073 CEST4436167313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.335585117 CEST61674443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.335598946 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.335644007 CEST61674443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.335659981 CEST4436167413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.336376905 CEST61675443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.336376905 CEST61675443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.336415052 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.336441040 CEST4436167513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.339066029 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.339154959 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.340008020 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.340039968 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.340949059 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341001034 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341069937 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341085911 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341547966 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341749907 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341784954 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341813087 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341834068 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.341983080 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.342024088 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.777244091 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.779083014 CEST61676443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.779099941 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.779723883 CEST61676443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.779730082 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.876868010 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.876914024 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.877137899 CEST61676443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.877172947 CEST61676443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.877172947 CEST61676443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.877192020 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.877202988 CEST4436167613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.880178928 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.880227089 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.880322933 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.880462885 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.880479097 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.991059065 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.991599083 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.991642952 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.992094040 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:03.992106915 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.003496885 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.005682945 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.005732059 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.006042004 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.006061077 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.107326984 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.107414007 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.107455969 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.107501030 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.107553959 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.107588053 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.107609987 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134432077 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134452105 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134531021 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134552002 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134844065 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134871960 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134892941 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134964943 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.134989023 CEST4436168013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.135595083 CEST61680443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.137604952 CEST61682443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.137660980 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.137732029 CEST61682443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.137876987 CEST61682443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.137896061 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194216013 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194335938 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194418907 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194457054 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194466114 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194466114 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194510937 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194549084 CEST61678443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.194565058 CEST4436167813.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.196988106 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.197031021 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.197115898 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.197253942 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.197269917 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.449134111 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.454219103 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.522034883 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.522802114 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.522845030 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.523304939 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.523312092 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.560739994 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.566797972 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.627191067 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.627209902 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.627224922 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.627329111 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.627365112 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.627604961 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.711941004 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712023020 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712037086 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712074041 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712085962 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712192059 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712254047 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712280989 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712295055 CEST61681443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.712301970 CEST4436168113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.716372013 CEST61684443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.716417074 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.716727018 CEST61684443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.717952013 CEST61684443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.717963934 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.814136982 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.835091114 CEST61682443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.835123062 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.835541010 CEST61682443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.835546970 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.852478981 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.858633995 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.858721972 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.859033108 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.859086037 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.937927008 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.937949896 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.938009977 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.938278913 CEST61682443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.938368082 CEST61682443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.938381910 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.938395977 CEST61682443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.938401937 CEST4436168213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.941807032 CEST61685443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.941854954 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.942491055 CEST61685443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.943126917 CEST61685443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.943141937 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957004070 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957056046 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957190990 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957241058 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957346916 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957452059 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957484961 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957511902 CEST61683443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.957525969 CEST4436168313.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.960273981 CEST61686443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.960285902 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.960489035 CEST61686443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.960650921 CEST61686443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.960660934 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.279104948 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.282373905 CEST61684443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.282423973 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.282861948 CEST61684443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.282870054 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.353162050 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.353260040 CEST4436168734.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.356198072 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.358392000 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.358433008 CEST4436168734.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.361115932 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.361208916 CEST4436168834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.362227917 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.362366915 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.362401009 CEST4436168834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.381068945 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.381131887 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.381568909 CEST61684443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.381849051 CEST61684443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.381870031 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.381886959 CEST61684443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.381894112 CEST4436168413.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.384589911 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.384612083 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.385739088 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.386009932 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.386024952 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.610460997 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.611776114 CEST61685443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.611809969 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.612174034 CEST61685443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.612179041 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.631930113 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.635874987 CEST61686443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.635888100 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.636420965 CEST61686443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.636424065 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.677794933 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.684252024 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.684310913 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.684590101 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.684602976 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.712025881 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.712097883 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.715349913 CEST61685443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.715537071 CEST61685443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.715548992 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.715586901 CEST61685443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.715591908 CEST4436168513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.724004984 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.724040985 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.730767012 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.734749079 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.734888077 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.743423939 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.752666950 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.753789902 CEST61686443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.785002947 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.785022974 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.786267996 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.786309004 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.787117958 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.787156105 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.787256002 CEST61686443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.787270069 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.787277937 CEST61686443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.787282944 CEST4436168613.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.798732042 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.798774958 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.824944973 CEST4436168734.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.828545094 CEST4436168834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.835402012 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.835429907 CEST4436168734.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.835484982 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.838572979 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.838606119 CEST4436168734.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.838697910 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.839433908 CEST4436168734.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.899820089 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.964633942 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.964692116 CEST4436168834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.965526104 CEST4436168834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.010288000 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.016415119 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.016464949 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.016927958 CEST4436168734.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.020862103 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.021359921 CEST4436168834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.024878979 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.024935007 CEST4436168834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.030440092 CEST61687443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.030461073 CEST61688443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.037020922 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.043256044 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.043273926 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.044944048 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.044950008 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.045399904 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.045433044 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.045449972 CEST61677443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.045459986 CEST4436167713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.090543032 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.090992928 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.094413996 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.094422102 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.094997883 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.095004082 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.095695972 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.101125002 CEST61691443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.101221085 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.101386070 CEST61691443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.101520061 CEST61691443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.101540089 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.103471041 CEST61692443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.103558064 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.103918076 CEST61692443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.104295969 CEST61692443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.104329109 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.125768900 CEST61693443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.125787973 CEST4436169334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.126154900 CEST61693443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.126270056 CEST61693443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.126282930 CEST4436169334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.127832890 CEST61694443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.127840042 CEST4436169434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.127908945 CEST61694443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.128012896 CEST61694443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.128019094 CEST4436169434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.143698931 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.143754959 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.143973112 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.143984079 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.144238949 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.144238949 CEST61679443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.144249916 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.144340992 CEST4436167913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.146373987 CEST61695443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.146414995 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.146641016 CEST61695443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.146765947 CEST61695443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.146794081 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.150115967 CEST61696443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.150182962 CEST4436169634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.150429964 CEST61696443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.150537014 CEST61696443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.150566101 CEST4436169634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.186651945 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.191800117 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.192994118 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.207500935 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.207900047 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.207917929 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.207930088 CEST61689443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.207936049 CEST4436168913.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.222091913 CEST61697443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.222146034 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.222676992 CEST61697443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.223249912 CEST61697443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.223272085 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.232012033 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.237054110 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.241889954 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.335072994 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.390665054 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.441240072 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.441685915 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.441695929 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.442082882 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.442085981 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.541754007 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.541779995 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.541825056 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.541838884 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.541882992 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.542098999 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.542119026 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.542129040 CEST61690443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.542134047 CEST4436169013.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.593797922 CEST4436169334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.593899012 CEST61693443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.597876072 CEST61693443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.597884893 CEST4436169334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.598562956 CEST4436169334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.600512028 CEST61693443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.600667953 CEST61693443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.600698948 CEST4436169334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.603786945 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.605772972 CEST61693443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.606415033 CEST4436169434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.606487989 CEST61694443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.608649015 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.609498024 CEST61694443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.609503984 CEST4436169434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.609739065 CEST4436169434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.613775015 CEST61694443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.613852978 CEST61694443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.613924980 CEST4436169434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.614033937 CEST61694443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.627334118 CEST4436169634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.627408981 CEST61696443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.631520987 CEST61696443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.631534100 CEST4436169634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.631891012 CEST4436169634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.634862900 CEST61696443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.634973049 CEST61696443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.634993076 CEST4436169634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.636029005 CEST61696443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.699425936 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.727905989 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.732867002 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.743537903 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.744301081 CEST61691443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.744379997 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.744401932 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.744950056 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.745646954 CEST61691443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.745661020 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.745986938 CEST61692443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.746059895 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.746330976 CEST61692443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.746345043 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.752454996 CEST61698443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.752551079 CEST4436169834.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.752635002 CEST61698443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.753844023 CEST61698443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.753878117 CEST4436169834.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.818681955 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.819853067 CEST61695443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.819870949 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.820405960 CEST61695443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.820410967 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.826948881 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.843806982 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.843857050 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.844111919 CEST61691443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.844285011 CEST61691443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.844307899 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.844321012 CEST61691443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.844327927 CEST4436169113.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.849787951 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.849935055 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.852159023 CEST61692443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.852498055 CEST61692443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.852509022 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.852519989 CEST61692443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.852524996 CEST4436169213.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.876513004 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.885773897 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.889714956 CEST61697443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.889734983 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.890142918 CEST61697443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.890150070 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.939448118 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.939527035 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.939692974 CEST61695443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.939735889 CEST61695443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.939750910 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.939759970 CEST61695443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.939764023 CEST4436169513.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.993221998 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.993484020 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.993834972 CEST61697443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.994021893 CEST61697443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.994045019 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.994060040 CEST61697443192.168.2.513.107.246.45
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.994066000 CEST4436169713.107.246.45192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.220458031 CEST4436169834.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.221147060 CEST61698443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.226717949 CEST61698443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.226752043 CEST4436169834.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.226835966 CEST61698443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.226919889 CEST4436169834.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.227510929 CEST61698443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.229679108 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.234639883 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.325546980 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.328833103 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.333916903 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.379435062 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.429080009 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.479697943 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:14.992737055 CEST61700443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:14.992795944 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:14.992986917 CEST61700443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:14.993211985 CEST61700443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:14.993228912 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:15.756123066 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:15.756474018 CEST61700443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:15.756541014 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:15.757642031 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:15.757970095 CEST61700443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:15.758146048 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:15.809916019 CEST61700443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:17.325628996 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:17.439140081 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:17.482903957 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:17.482928038 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.985860109 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.985960007 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.986089945 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.986320019 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.986351967 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.998223066 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.998312950 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.998459101 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.998611927 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.998639107 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.621536970 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.621620893 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.621731997 CEST61700443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.631870031 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.632723093 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.633260965 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.633295059 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.633389950 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.633455992 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.633860111 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.634166002 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.634309053 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.634398937 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.634670019 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.634768009 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.634897947 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.634922981 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.634938002 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.635025978 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.635066986 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.635085106 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.932782888 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.933036089 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.933319092 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.933957100 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.936001062 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.936002970 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.936769962 CEST61704443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.936810017 CEST44361704216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.937431097 CEST61703443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:25.937474012 CEST44361703216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:27.499496937 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:27.501624107 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:27.504772902 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:27.506573915 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:37.522125006 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:37.522207022 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:37.527467012 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:37.527523994 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.529912949 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.530147076 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.535614014 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.535639048 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.886779070 CEST61706443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.886837006 CEST4436170634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.886940956 CEST61706443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.889520884 CEST61706443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.889537096 CEST4436170634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.382692099 CEST4436170634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.382774115 CEST61706443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.390731096 CEST61706443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.390744925 CEST4436170634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.390873909 CEST61706443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.390930891 CEST4436170634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.391151905 CEST61706443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.394979000 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.400290966 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.495829105 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.500735044 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.505902052 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.540119886 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.601552010 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.655982971 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.532807112 CEST61700443192.168.2.5172.217.18.4
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.532882929 CEST44361700172.217.18.4192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.533102036 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.533216000 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.534917116 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.535247087 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.535271883 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.560347080 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.560379982 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.560595036 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.560777903 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:55.560786009 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.193912029 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.199431896 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.199498892 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.200083017 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.200612068 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.227560043 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.227641106 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.227910042 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.228142977 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.228161097 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.228193998 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.228202105 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.228339911 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.228995085 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.231601954 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.231789112 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.231791019 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.231789112 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.231904030 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.280322075 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.280436039 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.495801926 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.495965004 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.496375084 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.496457100 CEST61708443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.496496916 CEST44361708216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.505400896 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.506165981 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.506238937 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.506396055 CEST61707443192.168.2.5216.58.206.46
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:56.506437063 CEST44361707216.58.206.46192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:58.498019934 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:58.503477097 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:58.607095003 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:58.612971067 CEST804973434.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:06:08.506017923 CEST4972880192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:06:08.621845007 CEST4973480192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:06:08.814580917 CEST804972834.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:06:08.815227032 CEST804973434.107.221.82192.168.2.5

                                                                                                                                                                                                                                                                                                                                                                        UDP Packets

                                                                                                                                                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.649333000 CEST5414853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.657263994 CEST53541481.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.664000034 CEST5335453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.671827078 CEST53533541.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.474793911 CEST5230153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.483793020 CEST4932653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.491286039 CEST53493261.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.494036913 CEST6269953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.501882076 CEST53626991.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.738210917 CEST6365353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.745760918 CEST53636531.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.749727011 CEST5471553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.757144928 CEST53547151.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.771023989 CEST6044653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.778100014 CEST53604461.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.441742897 CEST6387953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.442423105 CEST6485153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.448851109 CEST53638791.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.449491978 CEST53648511.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.468453884 CEST5490253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.475855112 CEST53549021.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.501812935 CEST5540653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.509011030 CEST53554061.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.513638973 CEST5086753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.520525932 CEST53508671.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.603854895 CEST5441353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.733488083 CEST4956653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.741036892 CEST53495661.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.746431112 CEST6470853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.753659010 CEST53647081.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.152122021 CEST6252653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.159782887 CEST53625261.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.168549061 CEST5752753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.175983906 CEST53575271.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.178626060 CEST5045353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.186434031 CEST53504531.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.280626059 CEST5502853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.288309097 CEST53550281.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.437874079 CEST5276453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.438479900 CEST5229153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.445415020 CEST53527641.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.446054935 CEST53522911.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.475228071 CEST53554441.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.497689962 CEST5328753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.505112886 CEST53532871.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.505367994 CEST53595481.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.506730080 CEST5263253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.513664961 CEST53526321.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.521022081 CEST5026453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.521224022 CEST5029553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST53502641.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528111935 CEST53502951.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.570916891 CEST53600731.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.932990074 CEST5866253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.933104992 CEST5115853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.939874887 CEST53511581.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.939965963 CEST53586621.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.177551031 CEST5612653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.203643084 CEST53564281.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.226980925 CEST53577161.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:18.186919928 CEST53538421.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.121164083 CEST5185953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.121892929 CEST6492153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.128429890 CEST53518591.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.128914118 CEST53649211.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.709373951 CEST5808753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.717067957 CEST53580871.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.717586040 CEST5196453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.724486113 CEST53519641.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.726762056 CEST5901453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.734057903 CEST53590141.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.159450054 CEST4940553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.160115004 CEST5704953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.166577101 CEST53494051.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.167018890 CEST53570491.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.131433964 CEST5838353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.143587112 CEST53583831.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.145061016 CEST5796053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.153002977 CEST53579601.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.167175055 CEST5457153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.176610947 CEST53545711.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.129745007 CEST4948753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.136879921 CEST53494871.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.138376951 CEST5727853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.145351887 CEST53572781.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.216753006 CEST6052453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.223562956 CEST53605241.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.537254095 CEST5099153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.544661999 CEST53509911.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.548966885 CEST5912653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.556220055 CEST53591261.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.559223890 CEST5095953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.566006899 CEST53509591.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:29.548440933 CEST53622821.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.806770086 CEST5391253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.813831091 CEST53539121.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:34.630708933 CEST53643511.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.246459961 CEST5510853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.254400969 CEST53551081.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.255362034 CEST5529353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.263436079 CEST53552931.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.635405064 CEST5475253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.642510891 CEST53547521.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.645325899 CEST5091353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.652686119 CEST53509131.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.653631926 CEST5554353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.661783934 CEST53555431.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.689299107 CEST6056053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.697518110 CEST53605601.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.699681997 CEST5036753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.707159042 CEST53503671.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.715374947 CEST6267753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.722831964 CEST53626771.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.998761892 CEST5912553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.007297039 CEST53591251.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.010011911 CEST5337353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.016769886 CEST53533731.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.349082947 CEST6181553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.338386059 CEST4976153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.346111059 CEST53497611.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.751938105 CEST5046453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.758667946 CEST53504641.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.759716034 CEST4965253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.766669989 CEST53496521.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:10.515912056 CEST53641241.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:23.046123028 CEST53608881.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.977993011 CEST5617453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.978199959 CEST6262253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.985340118 CEST53561741.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.985383034 CEST53626221.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.877099037 CEST6354653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.885431051 CEST53635461.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.886717081 CEST5099253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.893829107 CEST53509921.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.395090103 CEST4955353192.168.2.51.1.1.1

                                                                                                                                                                                                                                                                                                                                                                        DNS Queries

                                                                                                                                                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.649333000 CEST192.168.2.51.1.1.10x419bStandard query (0)prod.classify-client.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.664000034 CEST192.168.2.51.1.1.10x2adStandard query (0)prod.classify-client.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.474793911 CEST192.168.2.51.1.1.10xaaacStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.483793020 CEST192.168.2.51.1.1.10xab99Standard query (0)prod.detectportal.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.494036913 CEST192.168.2.51.1.1.10x6869Standard query (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.738210917 CEST192.168.2.51.1.1.10x49b8Standard query (0)youtube.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.749727011 CEST192.168.2.51.1.1.10xa5bfStandard query (0)youtube.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.771023989 CEST192.168.2.51.1.1.10x6b09Standard query (0)youtube.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.441742897 CEST192.168.2.51.1.1.10x47a7Standard query (0)example.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.442423105 CEST192.168.2.51.1.1.10xfb9bStandard query (0)ipv4only.arpaA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.468453884 CEST192.168.2.51.1.1.10x7100Standard query (0)contile.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.501812935 CEST192.168.2.51.1.1.10x726eStandard query (0)contile.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.513638973 CEST192.168.2.51.1.1.10xf349Standard query (0)contile.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.603854895 CEST192.168.2.51.1.1.10xfcbbStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.733488083 CEST192.168.2.51.1.1.10x5a00Standard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.746431112 CEST192.168.2.51.1.1.10x1052Standard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.152122021 CEST192.168.2.51.1.1.10xc967Standard query (0)spocs.getpocket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.168549061 CEST192.168.2.51.1.1.10x63fbStandard query (0)prod.ads.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.178626060 CEST192.168.2.51.1.1.10xa6c5Standard query (0)prod.ads.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.280626059 CEST192.168.2.51.1.1.10x7ff5Standard query (0)content-signature-2.cdn.mozilla.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.437874079 CEST192.168.2.51.1.1.10xe567Standard query (0)youtube.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.438479900 CEST192.168.2.51.1.1.10x7225Standard query (0)youtube.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.497689962 CEST192.168.2.51.1.1.10xfe50Standard query (0)prod.content-signature-chains.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.506730080 CEST192.168.2.51.1.1.10xd9d3Standard query (0)prod.content-signature-chains.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.521022081 CEST192.168.2.51.1.1.10xbd65Standard query (0)www.youtube.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.521224022 CEST192.168.2.51.1.1.10x4417Standard query (0)www.youtube.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.932990074 CEST192.168.2.51.1.1.10x2171Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.933104992 CEST192.168.2.51.1.1.10x6f7eStandard query (0)www.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.177551031 CEST192.168.2.51.1.1.10xc894Standard query (0)shavar.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.121164083 CEST192.168.2.51.1.1.10xca6eStandard query (0)accounts.youtube.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.121892929 CEST192.168.2.51.1.1.10x120fStandard query (0)accounts.youtube.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.709373951 CEST192.168.2.51.1.1.10x8b03Standard query (0)support.mozilla.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.717586040 CEST192.168.2.51.1.1.10x334bStandard query (0)us-west1.prod.sumo.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.726762056 CEST192.168.2.51.1.1.10xcd05Standard query (0)us-west1.prod.sumo.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.159450054 CEST192.168.2.51.1.1.10x5119Standard query (0)play.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.160115004 CEST192.168.2.51.1.1.10x5d1Standard query (0)play.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.131433964 CEST192.168.2.51.1.1.10x34a2Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.145061016 CEST192.168.2.51.1.1.10x8f6Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.167175055 CEST192.168.2.51.1.1.10x70b8Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.129745007 CEST192.168.2.51.1.1.10xcc6Standard query (0)telemetry-incoming.r53-2.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.138376951 CEST192.168.2.51.1.1.10xd6a6Standard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.216753006 CEST192.168.2.51.1.1.10xa6caStandard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.537254095 CEST192.168.2.51.1.1.10x87b7Standard query (0)firefox.settings.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.548966885 CEST192.168.2.51.1.1.10xc877Standard query (0)prod.remote-settings.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.559223890 CEST192.168.2.51.1.1.10x8aadStandard query (0)prod.remote-settings.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:31.806770086 CEST192.168.2.51.1.1.10xa1ddStandard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.246459961 CEST192.168.2.51.1.1.10x7fcfStandard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.255362034 CEST192.168.2.51.1.1.10x55d1Standard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.635405064 CEST192.168.2.51.1.1.10xfd21Standard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.645325899 CEST192.168.2.51.1.1.10xb6fcStandard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.653631926 CEST192.168.2.51.1.1.10x2f1aStandard query (0)services.addons.mozilla.org28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.689299107 CEST192.168.2.51.1.1.10xb489Standard query (0)normandy.cdn.mozilla.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.699681997 CEST192.168.2.51.1.1.10x9427Standard query (0)normandy-cdn.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.715374947 CEST192.168.2.51.1.1.10x61cbStandard query (0)normandy-cdn.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:45.998761892 CEST192.168.2.51.1.1.10x53d7Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.010011911 CEST192.168.2.51.1.1.10x4806Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.349082947 CEST192.168.2.51.1.1.10xd3dStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.338386059 CEST192.168.2.51.1.1.10xbe8fStandard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.751938105 CEST192.168.2.51.1.1.10xef00Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.759716034 CEST192.168.2.51.1.1.10xd3b9Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.977993011 CEST192.168.2.51.1.1.10x9b2dStandard query (0)play.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.978199959 CEST192.168.2.51.1.1.10x933dStandard query (0)play.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.877099037 CEST192.168.2.51.1.1.10xe37cStandard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.886717081 CEST192.168.2.51.1.1.10x4c56Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.395090103 CEST192.168.2.51.1.1.10xa9b7Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                                                                                                                                        DNS Answers

                                                                                                                                                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.619079113 CEST1.1.1.1192.168.2.50x134aNo error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:06.657263994 CEST1.1.1.1192.168.2.50x419bNo error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.482364893 CEST1.1.1.1192.168.2.50xaaacNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.482364893 CEST1.1.1.1192.168.2.50xaaacNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.491286039 CEST1.1.1.1192.168.2.50xab99No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.501882076 CEST1.1.1.1192.168.2.50x6869No error (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.745760918 CEST1.1.1.1192.168.2.50x49b8No error (0)youtube.com142.250.181.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.757144928 CEST1.1.1.1192.168.2.50xa5bfNo error (0)youtube.com142.250.186.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.778100014 CEST1.1.1.1192.168.2.50x6b09No error (0)youtube.com28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.448851109 CEST1.1.1.1192.168.2.50x47a7No error (0)example.org93.184.215.14A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.449491978 CEST1.1.1.1192.168.2.50xfb9bNo error (0)ipv4only.arpa192.0.0.171A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.449491978 CEST1.1.1.1192.168.2.50xfb9bNo error (0)ipv4only.arpa192.0.0.170A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.475855112 CEST1.1.1.1192.168.2.50x7100No error (0)contile.services.mozilla.com34.117.188.166A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.509011030 CEST1.1.1.1192.168.2.50x726eNo error (0)contile.services.mozilla.com34.117.188.166A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.610941887 CEST1.1.1.1192.168.2.50xfcbbNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.610941887 CEST1.1.1.1192.168.2.50xfcbbNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.680871010 CEST1.1.1.1192.168.2.50x2ab6No error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.680871010 CEST1.1.1.1192.168.2.50x2ab6No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.741036892 CEST1.1.1.1192.168.2.50x5a00No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.159782887 CEST1.1.1.1192.168.2.50xc967No error (0)spocs.getpocket.comprod.ads.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.159782887 CEST1.1.1.1192.168.2.50xc967No error (0)prod.ads.prod.webservices.mozgcp.net34.117.188.166A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.175983906 CEST1.1.1.1192.168.2.50x63fbNo error (0)prod.ads.prod.webservices.mozgcp.net34.117.188.166A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.288309097 CEST1.1.1.1192.168.2.50x7ff5No error (0)content-signature-2.cdn.mozilla.netcontent-signature-chains.prod.autograph.services.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.288309097 CEST1.1.1.1192.168.2.50x7ff5No error (0)content-signature-chains.prod.autograph.services.mozaws.netprod.content-signature-chains.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.288309097 CEST1.1.1.1192.168.2.50x7ff5No error (0)prod.content-signature-chains.prod.webservices.mozgcp.net34.160.144.191A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.445415020 CEST1.1.1.1192.168.2.50xe567No error (0)youtube.com142.250.184.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.446054935 CEST1.1.1.1192.168.2.50x7225No error (0)youtube.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.505112886 CEST1.1.1.1192.168.2.50xfe50No error (0)prod.content-signature-chains.prod.webservices.mozgcp.net34.160.144.191A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:11.513664961 CEST1.1.1.1192.168.2.50xd9d3No error (0)prod.content-signature-chains.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)www.youtube.comyoutube-ui.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.185.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.186.78A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.184.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.186.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com172.217.16.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com216.58.212.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.186.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.181.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.184.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.186.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com172.217.18.14A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com216.58.206.78A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.185.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.74.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com142.250.186.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528050900 CEST1.1.1.1192.168.2.50xbd65No error (0)youtube-ui.l.google.com172.217.16.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528111935 CEST1.1.1.1192.168.2.50x4417No error (0)www.youtube.comyoutube-ui.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.528111935 CEST1.1.1.1192.168.2.50x4417No error (0)youtube-ui.l.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.939874887 CEST1.1.1.1192.168.2.50x6f7eNo error (0)www.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.939965963 CEST1.1.1.1192.168.2.50x2171No error (0)www.google.com172.217.18.4A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:15.185149908 CEST1.1.1.1192.168.2.50xc894No error (0)shavar.services.mozilla.comshavar.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.128429890 CEST1.1.1.1192.168.2.50xca6eNo error (0)accounts.youtube.comwww3.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.128429890 CEST1.1.1.1192.168.2.50xca6eNo error (0)www3.l.google.com142.250.186.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.128914118 CEST1.1.1.1192.168.2.50x120fNo error (0)accounts.youtube.comwww3.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.717067957 CEST1.1.1.1192.168.2.50x8b03No error (0)support.mozilla.orgprod.sumo.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.717067957 CEST1.1.1.1192.168.2.50x8b03No error (0)prod.sumo.prod.webservices.mozgcp.netus-west1.prod.sumo.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.717067957 CEST1.1.1.1192.168.2.50x8b03No error (0)us-west1.prod.sumo.prod.webservices.mozgcp.net34.149.128.2A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.724486113 CEST1.1.1.1192.168.2.50x334bNo error (0)us-west1.prod.sumo.prod.webservices.mozgcp.net34.149.128.2A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:22.166577101 CEST1.1.1.1192.168.2.50x5119No error (0)play.google.com142.250.186.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.143587112 CEST1.1.1.1192.168.2.50x34a2No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:23.153002977 CEST1.1.1.1192.168.2.50x8f6No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.128829956 CEST1.1.1.1192.168.2.50x25b6No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.136879921 CEST1.1.1.1192.168.2.50xcc6No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.213205099 CEST1.1.1.1192.168.2.50x3a0dNo error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.213205099 CEST1.1.1.1192.168.2.50x3a0dNo error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.544661999 CEST1.1.1.1192.168.2.50x87b7No error (0)firefox.settings.services.mozilla.comprod.remote-settings.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.544661999 CEST1.1.1.1192.168.2.50x87b7No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.556220055 CEST1.1.1.1192.168.2.50xc877No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.751565933 CEST1.1.1.1192.168.2.50xa9c3No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.245285034 CEST1.1.1.1192.168.2.50x1007No error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.245285034 CEST1.1.1.1192.168.2.50x1007No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.254400969 CEST1.1.1.1192.168.2.50x7fcfNo error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.642510891 CEST1.1.1.1192.168.2.50xfd21No error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.642510891 CEST1.1.1.1192.168.2.50xfd21No error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.642510891 CEST1.1.1.1192.168.2.50xfd21No error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.642510891 CEST1.1.1.1192.168.2.50xfd21No error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.652686119 CEST1.1.1.1192.168.2.50xb6fcNo error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.652686119 CEST1.1.1.1192.168.2.50xb6fcNo error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.652686119 CEST1.1.1.1192.168.2.50xb6fcNo error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.652686119 CEST1.1.1.1192.168.2.50xb6fcNo error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.697518110 CEST1.1.1.1192.168.2.50xb489No error (0)normandy.cdn.mozilla.netnormandy-cdn.services.mozilla.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.697518110 CEST1.1.1.1192.168.2.50xb489No error (0)normandy-cdn.services.mozilla.com35.201.103.21A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.707159042 CEST1.1.1.1192.168.2.50x9427No error (0)normandy-cdn.services.mozilla.com35.201.103.21A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.100020885 CEST1.1.1.1192.168.2.50xa3abNo error (0)a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.coma17.rackcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.100020885 CEST1.1.1.1192.168.2.50xa3abNo error (0)a17.rackcdn.coma17.rackcdn.com.mdc.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.007297039 CEST1.1.1.1192.168.2.50x53d7No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.355673075 CEST1.1.1.1192.168.2.50xd3dNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.355673075 CEST1.1.1.1192.168.2.50xd3dNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:05.344192982 CEST1.1.1.1192.168.2.50x22b5No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.125125885 CEST1.1.1.1192.168.2.50x1c8aNo error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.758667946 CEST1.1.1.1192.168.2.50xef00No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:24.985340118 CEST1.1.1.1192.168.2.50x9b2dNo error (0)play.google.com216.58.206.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.885431051 CEST1.1.1.1192.168.2.50xe37cNo error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.402476072 CEST1.1.1.1192.168.2.50xa9b7No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.402476072 CEST1.1.1.1192.168.2.50xa9b7No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                                                                                                                                                                                                                                                        • youtube.com
                                                                                                                                                                                                                                                                                                                                                                        • fs.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                        • slscr.update.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                        • otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        • https:
                                                                                                                                                                                                                                                                                                                                                                          • accounts.youtube.com
                                                                                                                                                                                                                                                                                                                                                                          • play.google.com
                                                                                                                                                                                                                                                                                                                                                                          • www.google.com
                                                                                                                                                                                                                                                                                                                                                                        • detectportal.firefox.com

                                                                                                                                                                                                                                                                                                                                                                        HTTP Packets

                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        0192.168.2.54971434.107.221.82807724C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:08.788166046 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.260673046 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 00:31:58 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 77531
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        1192.168.2.54971734.107.221.82807724C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:09.697254896 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:10.159832954 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72332
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        2192.168.2.54972834.107.221.82807724C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.406980038 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:12.882719994 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69325
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.414149046 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:16.510313988 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69329
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.604665995 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.705256939 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69337
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.887394905 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.983613014 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69337
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.194278955 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.367100954 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69338
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:27.902409077 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.048496962 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69340
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.236305952 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.332433939 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69348
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.934412003 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.030848026 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69348
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.199343920 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.295692921 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69349
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.571090937 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.666852951 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69349
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.711177111 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.806704044 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69349
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.048211098 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.161406040 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69350
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.511759043 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.608222961 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69359
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.348292112 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.445970058 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69367
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.449134111 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.090543032 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.186651945 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69379
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.603786945 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.699425936 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69379
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.229679108 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.325546980 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69380
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:17.325628996 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:27.499496937 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:37.522207022 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.529912949 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.394979000 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.495829105 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 90
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 02:48:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 69421
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:58.498019934 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:06:08.506017923 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        3192.168.2.54973434.107.221.82807724C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.038033962 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:14.505558014 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72336
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.701555967 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:21.800539970 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72343
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.835035086 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:24.936471939 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72346
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.193594933 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.371184111 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72347
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.439946890 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:25.540446043 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72347
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.050983906 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:28.149313927 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72350
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.635498047 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:35.733819008 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72357
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.041280031 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.141155958 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72358
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.310497046 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.411098957 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72358
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.670284986 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.770184994 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72358
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.812385082 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:36.926965952 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72358
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.164942980 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:37.269772053 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72359
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.612302065 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:46.721196890 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72368
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.449265003 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:04:54.547792912 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72376
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:04.560739994 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.237054110 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.335072994 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72388
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.727905989 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:06.826948881 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72388
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.328833103 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:07.429080009 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72389
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:17.439140081 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:27.501624107 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:37.522125006 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:47.530147076 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.500735044 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:48.601552010 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Server: nginx
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                                                                                                                        Via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 01:58:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Age: 72430
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                                                                                                                        Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: success
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:05:58.607095003 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:
                                                                                                                                                                                                                                                                                                                                                                        Oct 9, 2024 00:06:08.621845007 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii:


                                                                                                                                                                                                                                                                                                                                                                        HTTPS Proxied Packets

                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        0192.168.2.549724142.250.184.2064437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:12 UTC859OUTGET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: youtube.com
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-mobile: ?0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform: "Windows"
                                                                                                                                                                                                                                                                                                                                                                        Upgrade-Insecure-Requests: 1
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                                                                                                                                                                                                                                                                                        X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: none
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: navigate
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-User: ?1
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: document
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:12 UTC1704INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: application/binary
                                                                                                                                                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                                                                                                                                        Expires: Tue, 08 Oct 2024 22:04:12 GMT
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:12 GMT
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: private, max-age=31536000
                                                                                                                                                                                                                                                                                                                                                                        Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd
                                                                                                                                                                                                                                                                                                                                                                        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                                                                                        Content-Security-Policy: require-trusted-types-for 'script'
                                                                                                                                                                                                                                                                                                                                                                        Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
                                                                                                                                                                                                                                                                                                                                                                        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                        Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                        Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"
                                                                                                                                                                                                                                                                                                                                                                        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                                                                                                                                                                                                                                                                                                                                        Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
                                                                                                                                                                                                                                                                                                                                                                        Server: ESF
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 0
                                                                                                                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                                                                                                                        Connection: close


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        1192.168.2.549727184.28.90.27443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:12 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft BITS/7.8
                                                                                                                                                                                                                                                                                                                                                                        Host: fs.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:12 UTC466INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                                                                                                                                                                                                                                                                                                                        Server: ECAcc (lpl/EF45)
                                                                                                                                                                                                                                                                                                                                                                        X-CID: 11
                                                                                                                                                                                                                                                                                                                                                                        X-Ms-ApiVersion: Distribute 1.2
                                                                                                                                                                                                                                                                                                                                                                        X-Ms-Region: prod-weu-z1
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=67290
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:12 GMT
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        X-CID: 2


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        2192.168.2.549730184.28.90.27443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:13 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                                                                                                                                                        If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                                                                                                                                                                                                                                                                                                                                        Range: bytes=0-2147483646
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft BITS/7.8
                                                                                                                                                                                                                                                                                                                                                                        Host: fs.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:13 UTC514INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        ApiVersion: Distribute 1.1
                                                                                                                                                                                                                                                                                                                                                                        Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                                                                                                                                                                                                                                                                                                                        Server: ECAcc (lpl/EF06)
                                                                                                                                                                                                                                                                                                                                                                        X-CID: 11
                                                                                                                                                                                                                                                                                                                                                                        X-Ms-ApiVersion: Distribute 1.2
                                                                                                                                                                                                                                                                                                                                                                        X-Ms-Region: prod-weu-z1
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=67225
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:13 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 55
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        X-CID: 2
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:13 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        3192.168.2.5497384.175.87.197443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:16 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UHSu4tku32A9Dsw&MD=YD5C61TL HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                                                                                                                                                                                                                                                                                                        Host: slscr.update.microsoft.com
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC560INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: application/octet-stream
                                                                                                                                                                                                                                                                                                                                                                        Expires: -1
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                                                                                                                                                                                                                                                                                                                                        MS-CorrelationId: 9e7956ab-5c66-45e3-ab46-bd94087e7856
                                                                                                                                                                                                                                                                                                                                                                        MS-RequestId: 083d3ee8-8009-4526-8fda-d6dd31ff3fe5
                                                                                                                                                                                                                                                                                                                                                                        MS-CV: DlnIe2X1a0ql3WGc.0
                                                                                                                                                                                                                                                                                                                                                                        X-Microsoft-SLSClientCache: 2880
                                                                                                                                                                                                                                                                                                                                                                        Content-Disposition: attachment; filename=environment.cab
                                                                                                                                                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:16 GMT
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 24490
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        4192.168.2.54974213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:16 UTC195OUTGET /rules/other-Win32-v19.bundle HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC540INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:16 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 218853
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 08 Oct 2024 18:47:31 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DCE7C9AA69D9A7"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 323f49ff-801e-00ac-5eba-19fd65000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220416Z-1657d5bbd48wd55zet5pcra0cg00000005n0000000003y4d
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC15844INData Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:17 UTC16384INData Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        5192.168.2.54975213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule224902v2s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC471INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 450
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BD4C869AE"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: cfc4547a-a01e-0098-41ce-198556000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd48jwrqbupe3ktsx9w00000005vg000000004aw0
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_MISS
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC450INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        6192.168.2.54975113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC193OUTGET /rules/rule120402v21s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 3788
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BAC2126A6"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 4545068c-701e-0050-0e05-176767000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd48brl8we3nu8cxwgn00000005y0000000008dxd
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC3788INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        7192.168.2.54975413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule120609v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 408
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB56D3AFB"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 28f6fc08-301e-0020-466a-176299000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd48dfrdj7px744zp8s00000005bg00000000ap36
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC408INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        8192.168.2.54975313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule120600v4s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 2980
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA80D96A1"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd48tqvfc1ysmtbdrg000000005e000000000e4tc
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC2980INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        9192.168.2.54975513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule120608v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 2160
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA3B95D81"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: c59bb0f9-701e-0097-2d01-17b8c1000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd48qjg85buwfdynm5w00000005p000000000g49k
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC2160INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        10192.168.2.54976313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule120610v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 474
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9964B277"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd48vhs7r2p1ky7cs5w00000005x000000000axs0
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        11192.168.2.54976013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule120611v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 415
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9F6F3512"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 1707b783-801e-00a3-53e5-167cfb000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd48qjg85buwfdynm5w00000005p000000000g4d6
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        12192.168.2.54976113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule120612v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 471
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB10C598B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 73fc0cc0-d01e-008e-5fee-16387a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd482lxwq1dp2t1zwkc00000005c000000000759q
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        13192.168.2.54976413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule120613v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 632
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB6E3779E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220418Z-1657d5bbd48xlwdx82gahegw4000000005vg000000002y5p
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC632INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        14192.168.2.54976513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:18 UTC192OUTGET /rules/rule120614v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:19 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 467
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA6C038BC"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 87fc294c-201e-0051-40f3-167340000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220419Z-1657d5bbd482lxwq1dp2t1zwkc000000057000000000xh6x
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC467INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        15192.168.2.54976613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC192OUTGET /rules/rule120615v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:19 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 407
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BBAD04B7B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 789c8418-601e-0032-5905-17eebb000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220419Z-1657d5bbd4824mj9d6vp65b6n400000005qg00000000sspc
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        16192.168.2.54976713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC192OUTGET /rules/rule120616v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:19 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 486
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB344914B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 0a3893d3-c01e-0082-33ee-16af72000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220419Z-1657d5bbd482lxwq1dp2t1zwkc000000059g00000000km0q
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        17192.168.2.54976813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC192OUTGET /rules/rule120617v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:19 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 427
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA310DA18"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 963c34db-c01e-00ad-34ed-18a2b9000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220419Z-1657d5bbd48gqrfwecymhhbfm800000004dg00000000ak4a
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        18192.168.2.54976913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC192OUTGET /rules/rule120618v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:19 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 486
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9018290B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 2bf76a5c-f01e-0096-08eb-1810ef000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220419Z-1657d5bbd48sdh4cyzadbb374800000005d000000000fu4z
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        19192.168.2.54977013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:19 UTC192OUTGET /rules/rule120619v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:19 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 407
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9698189B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 99ffd5e0-b01e-0053-0101-17cdf8000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220419Z-1657d5bbd48762wn1qw4s5sd3000000005eg00000000cu6x
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        20192.168.2.54977113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC192OUTGET /rules/rule120620v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:20 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 469
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BBA701121"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: e72ec3ca-501e-005b-2401-17d7f7000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220420Z-1657d5bbd48qjg85buwfdynm5w00000005mg00000000q2nw
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC469INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        21192.168.2.54977213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC192OUTGET /rules/rule120621v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:20 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 415
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA41997E3"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 27ba9a72-001e-0046-2a01-17da4b000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220420Z-1657d5bbd48qjg85buwfdynm5w00000005t00000000002fx
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        22192.168.2.54977313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC192OUTGET /rules/rule120622v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:20 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 477
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB8CEAC16"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: c2d0a885-201e-0003-7ced-16f85a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220420Z-1657d5bbd48762wn1qw4s5sd3000000005d000000000n00s
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        23192.168.2.54977413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC192OUTGET /rules/rule120623v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:20 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 464
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B97FB6C3C"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 5a59384b-a01e-0053-3602-178603000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220420Z-1657d5bbd48brl8we3nu8cxwgn00000005xg00000000angd
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC464INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        24192.168.2.54978113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC192OUTGET /rules/rule120624v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC471INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:20 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 494
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB7010D66"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: ebb8cdcc-501e-0078-6cce-1906cf000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220420Z-1657d5bbd48lknvp09v995n790000000054g00000000su9u
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_MISS
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:20 UTC494INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        25192.168.2.54978313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC192OUTGET /rules/rule120626v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:21 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 472
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9DACDF62"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 20b36261-201e-006e-7102-17bbe3000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220421Z-1657d5bbd48gqrfwecymhhbfm800000004bg00000000ncr7
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        26192.168.2.54978413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC192OUTGET /rules/rule120627v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:21 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 404
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9E8EE0F3"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b6b3ae71-d01e-0028-6ce6-187896000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220421Z-1657d5bbd487nf59mzf5b3gk8n000000058g000000006axm
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC404INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        27192.168.2.54978513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC192OUTGET /rules/rule120628v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:21 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9C8E04C8"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 81e42967-c01e-0014-5ee9-16a6a3000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220421Z-1657d5bbd48wd55zet5pcra0cg00000005m00000000080hn
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        28192.168.2.54978213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC192OUTGET /rules/rule120625v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:21 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 419
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9748630E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 09392ef7-101e-0046-3f05-1791b0000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220421Z-1657d5bbd48vhs7r2p1ky7cs5w00000005v000000000mxqw
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        29192.168.2.54978613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC192OUTGET /rules/rule120629v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:21 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 428
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BAC4F34CA"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 6be05283-001e-00a2-2700-17d4d5000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220421Z-1657d5bbd48lknvp09v995n790000000054000000000v388
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC428INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        30192.168.2.549787142.250.186.464437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:21 UTC1223OUTGET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=802863228&timestamp=1728425060295 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: accounts.youtube.com
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-mobile: ?0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-arch: "x86"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform: "Windows"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform-version: "10.0.0"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-model: ""
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-bitness: "64"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-wow64: ?0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        Upgrade-Insecure-Requests: 1
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                                                                                                                                                                                                                                                                                        X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: cross-site
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: navigate
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: iframe
                                                                                                                                                                                                                                                                                                                                                                        Referer: https://accounts.google.com/
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                                                                                                                                        X-Frame-Options: ALLOW-FROM https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        Content-Security-Policy: script-src 'report-sample' 'nonce-rrPr0imsFPtbGodHpMpW5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self'
                                                                                                                                                                                                                                                                                                                                                                        Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist
                                                                                                                                                                                                                                                                                                                                                                        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                        Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:21 GMT
                                                                                                                                                                                                                                                                                                                                                                        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                        Cross-Origin-Opener-Policy: same-origin
                                                                                                                                                                                                                                                                                                                                                                        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                                                                                                                                                                                                                                                                                                                                        Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                                                                                                                                                        reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjstDikmII1JBikPj6kkkNiJ3SZ7AGAHHSv_OsBUB8ufsS63UgVu25xGoMxEUSV1gbgFiIh-PpjWk72ARWXJt_i1lJLym_MD4zJTWvJLOkMiU_NzEzLzk_Pzsztbg4tagstSjeyMDIxMDSyFLPwCK-wAAA6tgtug"
                                                                                                                                                                                                                                                                                                                                                                        Server: ESF
                                                                                                                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: none
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 37 36 31 63 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 72 72 50 72 30 69 6d 73 46 50 74 62 47 6f 64 48 70 4d 70 57 35 67 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 761c<html><head><script nonce="rrPr0imsFPtbGodHpMpW5g">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs||{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s*(?:\\(
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 74 63 68 28 74 79 70 65 6f 66 20 61 29 7b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 61 29 3f 61 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 69 67 69 6e 74 22 3a 72 65 74 75 72 6e 28 41 61 3f 0a 61 3e 3d 42 61 26 26 61 3c 3d 43 61 3a 61 5b 30 5d 3d 3d 3d 22 2d 22 3f 75 61 28 61 2c 44 61 29 3a 75 61 28 61 2c 45 61 29 29 3f 4e 75 6d 62 65 72 28 61 29 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 20 61 3f 31 3a 30 3b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 69 66 28 61 29 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 69 66 28 43 28 61 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 46 61 26 26 61 21 3d 6e 75 6c 6c 26 26 61 20 69 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: tch(typeof a){case "number":return isFinite(a)?a:String(a);case "bigint":return(Aa?a>=Ba&&a<=Ca:a[0]==="-"?ua(a,Da):ua(a,Ea))?Number(a):String(a);case "boolean":return a?1:0;case "object":if(a)if(Array.isArray(a)){if(C(a))return}else if(Fa&&a!=null&&a in
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 7b 76 61 72 20 62 3b 69 66 28 61 26 26 28 62 3d 51 61 29 21 3d 6e 75 6c 6c 26 26 62 2e 68 61 73 28 61 29 26 26 28 62 3d 61 2e 43 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 3b 69 66 28 63 3d 3d 3d 62 2e 6c 65 6e 67 74 68 2d 31 26 26 41 28 64 29 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 26 26 0a 52 61 28 66 2c 61 29 7d 65 6c 73 65 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 26 26 52 61 28 64 2c 61 29 7d 61 3d 45 3f 61 2e 43 3a 4d 61 28 61 2e 43 2c 50 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 65 3d 21 45 3b 69 66 28 62 3d 61 2e 6c 65 6e 67 74 68 29 7b 64 3d 61 5b 62 2d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: {var b;if(a&&(b=Qa)!=null&&b.has(a)&&(b=a.C))for(var c=0;c<b.length;c++){var d=b[c];if(c===b.length-1&&A(d))for(var e in d){var f=d[e];Array.isArray(f)&&Ra(f,a)}else Array.isArray(d)&&Ra(d,a)}a=E?a.C:Ma(a.C,Pa,void 0,void 0,!1);e=!E;if(b=a.length){d=a[b-
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 57 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: ol.iterator",function(a){if(a)return a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=Wa[b[c]];typeof d==="function"&&type
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6b 29 7b 6b 3d 48 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 49 28 6b 2c 66 29 29
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: );e("freeze");e("preventExtensions");e("seal");var h=0,g=function(k){this.g=(h+=Math.random()+1).toString();if(k){k=H(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};g.prototype.set=function(k,l){if(!c(k))throw Error("i");d(k);if(!I(k,f))
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 75 72 6e 20 67 2e 76 61 6c 75 65 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 67 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: urn g.value})};c.prototype.forEach=function(g,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,g.call(k,m[1],m[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"||l=="function"?b.has(k)
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 3d 3d 3d 22 6e 75 6d 62 65 72 22 26 26 69 73 4e 61 4e 28 62 29 7d 7d 29 3b 76 61 72 20 66 62 3d 66 62 7c 7c 7b 7d 2c 71 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 62 3d 71 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 68 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 71 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 69 66 28 62 3d 62 5b 61 5b 63 5d 5d 2c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 7d 2c 69 62 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: on(a){return a?a:function(b){return typeof b==="number"&&isNaN(b)}});var fb=fb||{},q=this||self,gb=q._F_toggles||[],hb=function(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b},ib="closure_uid_"+(Math.random()*1E
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 74 65 78 74 5f 5f 39 38 34 33 38 32 3d 7b 7d 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 2e 73 65 76 65 72 69 74 79 3d 62 7d 3b 76 61 72 20 71 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 71 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 64 28 66 2c 68 2c 67 2c 6b 2c 6c 29 3b 61 28 7b 6d 65 73 73 61 67 65 3a 66 2c 66 69 6c 65 4e 61 6d 65 3a 68 2c 6c 69 6e 65 3a 67 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 67 2c 62 61 3a 6b 2c 65 72 72 6f 72 3a 6c 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 74 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 68
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: text__984382={});a.__closure__error__context__984382.severity=b};var qb=function(a,b,c){c=c||q;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&d(f,h,g,k,l);a({message:f,fileName:h,line:g,lineNumber:g,ba:k,error:l});return e}},tb=function(a){var b=h
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC1969INData Raw: 22 6e 75 6d 62 65 72 22 3a 66 3d 53 74 72 69 6e 67 28 66 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 66 3d 66 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 66 3d 28 66 3d 73 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 6e 67 74 68 3e 34 30 26 26 28 66 3d 66 2e 73 6c 69 63 65 28 30 2c 34 30 29 2b 22 2e 2e 2e 22 29 3b 63 2e 70 75 73 68 28 66 29 7d 62 2e 70 75 73 68 28 61 29 3b 63 2e 70 75 73 68 28 22 29 5c 6e 22 29 3b 74 72 79 7b 63 2e 70 75 73 68 28 77 62 28 61 2e 63 61 6c 6c 65 72 2c 62 29 29 7d 63 61 74 63 68 28 68 29 7b 63 2e 70 75 73 68 28 22 5b 65 78 63 65 70 74 69 6f 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: "number":f=String(f);break;case "boolean":f=f?"true":"false";break;case "function":f=(f=sb(f))?f:"[fn]";break;default:f=typeof f}f.length>40&&(f=f.slice(0,40)+"...");c.push(f)}b.push(a);c.push(")\n");try{c.push(wb(a.caller,b))}catch(h){c.push("[exception


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        31192.168.2.54979113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC192OUTGET /rules/rule120632v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:22 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 471
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB5815C4C"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 7cec3a6f-e01e-0033-3414-174695000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220422Z-1657d5bbd48gqrfwecymhhbfm800000004e0000000009n7m
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        32192.168.2.54978913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC192OUTGET /rules/rule120630v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:22 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 499
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B98CEC9F6"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: a4cde42a-401e-00a3-1f9c-198b09000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220422Z-1657d5bbd48gjrh9ymem1nvr1n00000001100000000060v8
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC499INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        33192.168.2.54979013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC192OUTGET /rules/rule120631v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:22 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 415
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B988EBD12"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: dc8c5847-801e-0048-5fcd-19f3fb000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220422Z-1657d5bbd48cpbzgkvtewk0wu000000005k000000000uwfr
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        34192.168.2.54979313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC192OUTGET /rules/rule120633v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:22 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 419
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB32BB5CB"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: d415a278-e01e-0051-6efe-1684b2000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220422Z-1657d5bbd48sqtlf1huhzuwq70000000059g00000000fhfv
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        35192.168.2.54979413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC192OUTGET /rules/rule120634v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:22 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 494
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB8972972"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 7c825ef0-601e-0001-5f02-17faeb000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220422Z-1657d5bbd48cpbzgkvtewk0wu000000005ng00000000hthu
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC494INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        36192.168.2.549795142.250.186.1424437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC549OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: play.google.com
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Request-Method: POST
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Request-Headers: x-goog-authuser
                                                                                                                                                                                                                                                                                                                                                                        Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: cors
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: same-site
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                                                                                        Referer: https://accounts.google.com/
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC520INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Max-Age: 86400
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Credentials: true
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Server: Playlog
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 0
                                                                                                                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                                                                                                                        Connection: close


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        37192.168.2.549797142.250.186.1424437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:22 UTC549OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: play.google.com
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Request-Method: POST
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Request-Headers: x-goog-authuser
                                                                                                                                                                                                                                                                                                                                                                        Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: cors
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: same-site
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                                                                                        Referer: https://accounts.google.com/
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC520INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Max-Age: 86400
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Credentials: true
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Server: Playlog
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 0
                                                                                                                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                                                                                                                        Connection: close


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        38192.168.2.54979813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120635v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9DAE3EC0"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 10df1352-f01e-00aa-105a-178521000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220423Z-1657d5bbd482krtfgrg72dfbtn00000005e0000000000c4n
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC420INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        39192.168.2.54979913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120636v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 472
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9D43097E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b27116a7-a01e-003d-3a00-1798d7000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220423Z-1657d5bbd48762wn1qw4s5sd3000000005hg000000000krm
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        40192.168.2.54980313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120639v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 423
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB7564CE8"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 53d847c8-c01e-0079-6fa9-19e51a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220423Z-1657d5bbd48xsz2nuzq4vfrzg800000005c000000000r42v
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC423INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        41192.168.2.54980213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120638v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 486
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B92FCB436"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b8f8ddc8-601e-0001-115a-17faeb000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220423Z-1657d5bbd48vlsxxpe15ac3q7n00000005k000000000d3hr
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        42192.168.2.54980013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120637v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 427
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA909FA21"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: a62739ea-301e-005d-6402-17e448000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220423Z-1657d5bbd482tlqpvyz9e93p5400000005p000000000edqb
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        43192.168.2.549805142.250.186.1424437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC1132OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: play.google.com
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 518
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-mobile: ?0
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-arch: "x86"
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform-version: "10.0.0"
                                                                                                                                                                                                                                                                                                                                                                        X-Goog-AuthUser: 0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-bitness: "64"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-model: ""
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-wow64: ?0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform: "Windows"
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: same-site
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: cors
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                                                                                        Referer: https://accounts.google.com/
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC518OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 34 32 35 30 36 31 33 34 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728425061346",null,null,null
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC933INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Credentials: true
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                                                                                                                                                                                                                                                                                                                                        Set-Cookie: NID=518=PfiPXBgeh0AEUADA1RBaZmYU6xoEk96_cIVg9cz4jB15RTN6PEL6IUUTtLfGHm9IO0tmmeciCNcyRyPdfRhQOkusc8VFq-8sN_bTQBl9kh6MoAkicIr2OyTcGHZnuUs9Gf1motz7EJxCx49os51WEDddns5reQYZGfGokIdUbkmZz55uPn4; expires=Wed, 09-Apr-2025 22:04:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
                                                                                                                                                                                                                                                                                                                                                                        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Server: Playlog
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: private
                                                                                                                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: none
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Expires: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        44192.168.2.549806142.250.186.1424437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC1132OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: play.google.com
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 519
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-mobile: ?0
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-arch: "x86"
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform-version: "10.0.0"
                                                                                                                                                                                                                                                                                                                                                                        X-Goog-AuthUser: 0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-bitness: "64"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-model: ""
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-wow64: ?0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform: "Windows"
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: same-site
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: cors
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                                                                                        Referer: https://accounts.google.com/
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC519OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 34 32 35 30 36 31 34 33 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728425061439",null,null,null
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC933INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Credentials: true
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                                                                                                                                                                                                                                                                                                                                        Set-Cookie: NID=518=J0EkMtTXPoTycP7KbDpsfAd6WfDdLEWBVcpDGfXNyetgottqucD2bqnEqRCA3UaOn4o-jdn6P3dkc_iu56AGHOD1s8K02EQOY0pDbHqEvfE6NLGI8x2DSwxrgb_UY4J7RGxQdJ4g4FAzw6WpvxtbBTwkCXeZhoSFoSqq6QpgSwRNnwC1CCQ; expires=Wed, 09-Apr-2025 22:04:24 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
                                                                                                                                                                                                                                                                                                                                                                        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Server: Playlog
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: private
                                                                                                                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: none
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Expires: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        45192.168.2.54980713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120640v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 478
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9B233827"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 4dd19665-401e-005b-7705-179c0c000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220423Z-1657d5bbd48qjg85buwfdynm5w00000005p000000000g4qz
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC478INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        46192.168.2.54980813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120641v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:23 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 404
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B95C61A3C"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 151ca1e1-401e-0029-2b03-179b43000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220423Z-1657d5bbd4824mj9d6vp65b6n400000005ug000000007nn9
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC404INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        47192.168.2.54980913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120643v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 400
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB2D62837"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 11b227e2-601e-0002-7f6b-17a786000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220424Z-1657d5bbd48tqvfc1ysmtbdrg000000005gg000000004f46
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC400INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        48192.168.2.54981013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:23 UTC192OUTGET /rules/rule120642v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB046B576"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: db28b7eb-d01e-0065-5efe-16b77a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220424Z-1657d5bbd48jwrqbupe3ktsx9w00000005sg00000000gdtd
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        49192.168.2.54981113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC192OUTGET /rules/rule120644v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 479
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB7D702D0"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b2c548d6-d01e-0082-4f03-17e489000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220424Z-1657d5bbd48xdq5dkwwugdpzr000000005x000000000dan2
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC479INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        50192.168.2.549736172.217.18.44437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC1222OUTGET /favicon.ico HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: www.google.com
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-mobile: ?0
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-arch: "x86"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform-version: "10.0.0"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-bitness: "64"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-model: ""
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-wow64: ?0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform: "Windows"
                                                                                                                                                                                                                                                                                                                                                                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                                                                                                                                                                                                                                                                                        X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: same-site
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: no-cors
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: image
                                                                                                                                                                                                                                                                                                                                                                        Referer: https://accounts.google.com/
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                                                                                                                                        Cookie: NID=518=J0EkMtTXPoTycP7KbDpsfAd6WfDdLEWBVcpDGfXNyetgottqucD2bqnEqRCA3UaOn4o-jdn6P3dkc_iu56AGHOD1s8K02EQOY0pDbHqEvfE6NLGI8x2DSwxrgb_UY4J7RGxQdJ4g4FAzw6WpvxtbBTwkCXeZhoSFoSqq6QpgSwRNnwC1CCQ
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC705INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                                                                                                                                                        Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
                                                                                                                                                                                                                                                                                                                                                                        Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 5430
                                                                                                                                                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                                                                                                                                        Server: sffe
                                                                                                                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 21:05:32 GMT
                                                                                                                                                                                                                                                                                                                                                                        Expires: Wed, 16 Oct 2024 21:05:32 GMT
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=691200
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: image/x-icon
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Age: 3532
                                                                                                                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC685INData Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: h& ( 0.v]X:X:rY
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC1390INData Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: BBBBBBF!4I
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC575INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: $'


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        51192.168.2.54981513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC192OUTGET /rules/rule120645v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 425
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BBA25094F"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 7709e3c3-b01e-0097-5e02-174f33000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220424Z-1657d5bbd48vlsxxpe15ac3q7n00000005kg00000000br47
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC425INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        52192.168.2.54981613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC192OUTGET /rules/rule120646v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 475
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB2BE84FD"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: c5dbf9be-001e-0017-2cf1-160c3c000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220424Z-1657d5bbd48brl8we3nu8cxwgn00000005x000000000bptq
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC475INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        53192.168.2.54981813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC192OUTGET /rules/rule120647v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 448
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB389F49B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 5a5a1e5c-a01e-001e-18f5-1649ef000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220424Z-1657d5bbd48xsz2nuzq4vfrzg800000005g0000000006cud
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC448INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        54192.168.2.54981913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC192OUTGET /rules/rule120648v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 491
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B98B88612"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 721d8bd8-801e-002a-4f00-1731dc000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220424Z-1657d5bbd48vhs7r2p1ky7cs5w00000005u000000000sagf
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC491INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        55192.168.2.54982113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC192OUTGET /rules/rule120649v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:24 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 416
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BAEA4B445"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: cb78c1b2-201e-003f-2e04-176d94000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220424Z-1657d5bbd48xsz2nuzq4vfrzg800000005eg00000000cyeb
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:24 UTC416INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        56192.168.2.54982713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC192OUTGET /rules/rule120652v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:25 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 471
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B97E6FCDD"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 2f3972b1-401e-0035-1b02-1782d8000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220425Z-1657d5bbd482krtfgrg72dfbtn00000005a000000000f8ne
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        57192.168.2.54982613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC192OUTGET /rules/rule120651v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:25 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 415
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA80D96A1"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 04801829-801e-00ac-6301-17fd65000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220425Z-1657d5bbd48brl8we3nu8cxwgn00000005sg00000000yw42
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        58192.168.2.54982513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC192OUTGET /rules/rule120650v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:25 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 479
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B989EE75B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 27b6de9f-001e-0046-1e00-17da4b000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220425Z-1657d5bbd48sdh4cyzadbb374800000005d000000000fueu
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC479INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        59192.168.2.54982913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC192OUTGET /rules/rule120654v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:25 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 477
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA54DCC28"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: cde3aec9-601e-0084-63e5-166b3f000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220425Z-1657d5bbd48xlwdx82gahegw4000000005rg00000000mnqp
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:25 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        60192.168.2.54982813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC192OUTGET /rules/rule120653v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:26 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 419
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9C710B28"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 1ed82642-401e-0048-7b12-170409000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220426Z-1657d5bbd48sqtlf1huhzuwq70000000059000000000kt1p
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        61192.168.2.54983513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC192OUTGET /rules/rule120655v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:26 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 419
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB7F164C3"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 3a03d6b9-d01e-0066-52e9-16ea17000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220426Z-1657d5bbd48tnj6wmberkg2xy800000005qg000000008upt
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        62192.168.2.54983613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC192OUTGET /rules/rule120656v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:26 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 477
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA48B5BDD"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 678513bd-b01e-0053-4460-17cdf8000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220426Z-1657d5bbd48q6t9vvmrkd293mg00000005n00000000050x2
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        63192.168.2.54983713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC192OUTGET /rules/rule120657v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:26 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 419
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9FF95F80"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 938e68e0-901e-0029-0160-17274a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220426Z-1657d5bbd48xsz2nuzq4vfrzg800000005h0000000002wfx
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        64192.168.2.54983813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC192OUTGET /rules/rule120658v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:26 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 472
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB650C2EC"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: d803a4ff-401e-0083-3904-17075c000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220426Z-1657d5bbd48dfrdj7px744zp8s000000058000000000svfu
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        65192.168.2.54984013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:26 UTC192OUTGET /rules/rule120659v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:26 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB3EAF226"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 285f1bc5-401e-0029-3a4a-199b43000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220426Z-1657d5bbd48t66tjar5xuq22r800000005g000000000q186
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        66192.168.2.54984113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC192OUTGET /rules/rule120660v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:27 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 485
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB9769355"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 8a5b80a7-801e-0067-69f1-18fe30000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220427Z-1657d5bbd48xlwdx82gahegw4000000005vg000000002yqc
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC485INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        67192.168.2.54984213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC192OUTGET /rules/rule120661v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:27 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 411
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B989AF051"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 8d044b15-901e-00ac-3902-17b69e000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220427Z-1657d5bbd48q6t9vvmrkd293mg00000005fg00000000r5uh
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC411INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        68192.168.2.54984313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC192OUTGET /rules/rule120662v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:27 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 470
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BBB181F65"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: e72b6989-501e-005b-2b00-17d7f7000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220427Z-1657d5bbd48q6t9vvmrkd293mg00000005eg00000000ve7g
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        69192.168.2.54984413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC192OUTGET /rules/rule120663v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:27 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 427
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB556A907"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 0377c3fc-101e-000b-65dc-165e5c000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220427Z-1657d5bbd48qjg85buwfdynm5w00000005q000000000bppn
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        70192.168.2.54984513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC192OUTGET /rules/rule120664v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:27 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 502
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB6A0D312"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: a5e58c1d-b01e-00ab-5ac9-16dafd000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220427Z-1657d5bbd48lknvp09v995n790000000058g000000006qvd
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC502INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        71192.168.2.54984613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC192OUTGET /rules/rule120665v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:29 UTC491INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:29 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 407
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B9D30478D"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: da6610aa-e01e-0099-7dc3-19da8a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220427Z-1657d5bbd48sdh4cyzadbb374800000005g00000000042pu
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        X-Cache-Info: L1_T2
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:29 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        72192.168.2.54984813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC192OUTGET /rules/rule120667v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:27 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 408
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB9B6040B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: f9fa1d86-c01e-00a1-014a-197e4a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220427Z-1657d5bbd48xjgsr3pyv9u71rc00000001p00000000029rf
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC408INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        73192.168.2.54984713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC192OUTGET /rules/rule120666v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:27 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 474
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB3F48DAE"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: ef9cab6f-f01e-0099-0d00-179171000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220427Z-1657d5bbd48brl8we3nu8cxwgn00000005zg000000001yvm
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:27 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        74192.168.2.54984913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC192OUTGET /rules/rule120668v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:28 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 469
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB3CAEBB8"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b67c2655-301e-0096-2300-17e71d000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220428Z-1657d5bbd48tqvfc1ysmtbdrg000000005bg00000000shck
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC469INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        75192.168.2.54985013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC192OUTGET /rules/rule120669v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:28 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 416
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB5284CCE"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 821e4157-c01e-0014-3301-17a6a3000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220428Z-1657d5bbd48xlwdx82gahegw4000000005q000000000uk1n
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC416INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        76192.168.2.54985113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC192OUTGET /rules/rule120670v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:28 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 472
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B91EAD002"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 763e8d43-601e-000d-6912-172618000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220428Z-1657d5bbd48xlwdx82gahegw4000000005u0000000008ndy
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        77192.168.2.54985213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC192OUTGET /rules/rule120671v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:28 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 432
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BAABA2A10"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: bfab55ab-401e-0015-6202-170e8d000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220428Z-1657d5bbd48tnj6wmberkg2xy800000005sg000000000r5v
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:28 UTC432INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        78192.168.2.54985613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:29 UTC192OUTGET /rules/rule120675v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:29 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:29 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 419
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA6CF78C8"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 3c7823fd-401e-0015-0c60-170e8d000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220429Z-1657d5bbd48qjg85buwfdynm5w00000005rg000000005sva
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:29 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        79192.168.2.54985413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:29 UTC192OUTGET /rules/rule120673v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:29 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:29 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 427
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB464F255"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: cc515549-501e-005b-0a44-19d7f7000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220429Z-1657d5bbd48vlsxxpe15ac3q7n00000005pg0000000009wr
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:29 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        80192.168.2.54985513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC192OUTGET /rules/rule120674v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 474
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA4037B0D"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 3b7b7106-501e-0064-43e7-161f54000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220430Z-1657d5bbd48762wn1qw4s5sd3000000005cg00000000qge9
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        81192.168.2.54985313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC192OUTGET /rules/rule120672v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 475
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BBA740822"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: e621acba-901e-0067-6b52-19b5cb000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220430Z-1657d5bbd48xjgsr3pyv9u71rc00000001hg00000000graz
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC475INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        82192.168.2.54985713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC192OUTGET /rules/rule120676v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 472
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B984BF177"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 2f576d96-401e-0047-3902-178597000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220430Z-1657d5bbd48t66tjar5xuq22r800000005k000000000dn5k
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        83192.168.2.54985813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC192OUTGET /rules/rule120677v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 405
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B942B6AFF"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: dfb96d6a-f01e-003f-17e5-16d19d000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220430Z-1657d5bbd48q6t9vvmrkd293mg00000005mg000000006h83
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        84192.168.2.54985913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC192OUTGET /rules/rule120678v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BBA642BF4"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: f5ee0945-901e-0083-4202-17bb55000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220430Z-1657d5bbd487nf59mzf5b3gk8n00000005ag00000000041m
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        85192.168.2.549860142.250.186.1424437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC1307OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Host: play.google.com
                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1215
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-mobile: ?0
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-arch: "x86"
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain;charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform-version: "10.0.0"
                                                                                                                                                                                                                                                                                                                                                                        X-Goog-AuthUser: 0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-bitness: "64"
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-model: ""
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-wow64: ?0
                                                                                                                                                                                                                                                                                                                                                                        sec-ch-ua-platform: "Windows"
                                                                                                                                                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                                                                                                                                                        Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: same-site
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: cors
                                                                                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                                                                                        Referer: https://accounts.google.com/
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                                                                                                                                        Cookie: NID=518=J0EkMtTXPoTycP7KbDpsfAd6WfDdLEWBVcpDGfXNyetgottqucD2bqnEqRCA3UaOn4o-jdn6P3dkc_iu56AGHOD1s8K02EQOY0pDbHqEvfE6NLGI8x2DSwxrgb_UY4J7RGxQdJ4g4FAzw6WpvxtbBTwkCXeZhoSFoSqq6QpgSwRNnwC1CCQ
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC1215OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 38 34 32 35 30 35 39 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1728425059000",null,null,null,
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC941INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                                                                                                                                                                                                                                                                                                                                        Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Credentials: true
                                                                                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                                                                                                                                                                                                                                                                                                                                        Set-Cookie: NID=518=OfX2uwCl2FRPLFjPn9mTsDjWdUXtbHCwMaZggdGHW2-V38fdyIokSumZEtOXk1_J3vT_ubFcQAfisFAd27YhEQqOHipa4lWhwu7qgbC1CnMfTtMVfxosLudCIGxneG93pCgAdtMac5DPRn4Wfj4ouW5E7tkYBcNCFvUleT96LEoRu1sSjy-S9xFc28Q; expires=Wed, 09-Apr-2025 22:04:30 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
                                                                                                                                                                                                                                                                                                                                                                        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/plain; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        Server: Playlog
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: private
                                                                                                                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: none
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Expires: Tue, 08 Oct 2024 22:04:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        86192.168.2.54986113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC192OUTGET /rules/rule120679v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC471INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 174
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B91D80E15"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 36c0fca6-001e-0065-27ce-190b73000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220430Z-1657d5bbd48tnj6wmberkg2xy800000005mg00000000pk37
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_MISS
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC174INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        87192.168.2.54986213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC192OUTGET /rules/rule120680v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:30 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1952
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B956B0F3D"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: d115c2b4-d01e-0014-30a3-19ed58000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220430Z-1657d5bbd48dfrdj7px744zp8s00000005cg000000005ty6
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:30 UTC1952INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        88192.168.2.54986313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC192OUTGET /rules/rule120681v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:31 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 958
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BA0A31B3B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 0c165d1d-a01e-000d-7dfe-16d1ea000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220431Z-1657d5bbd48t66tjar5xuq22r800000005m0000000007sxd
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC958INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        89192.168.2.54986413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC192OUTGET /rules/rule120682v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC470INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:31 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 501
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BACFDAACD"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: c2f609cb-201e-0003-75fd-16f85a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220431Z-1657d5bbd48tnj6wmberkg2xy800000005ng00000000fmpv
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC501INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        90192.168.2.54986513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC193OUTGET /rules/rule120602v10s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:31 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 2592
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BB5B890DB"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 33b4d0ae-a01e-0032-35ff-161949000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220431Z-1657d5bbd48tnj6wmberkg2xy800000005kg00000000tuts
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC2592INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        91192.168.2.54986613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC192OUTGET /rules/rule120601v3s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:31 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 3342
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582B927E47E9"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: dd3a6b2d-f01e-00aa-3a5d-198521000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220431Z-1657d5bbd48xjgsr3pyv9u71rc00000001k000000000e5nm
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC3342INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        92192.168.2.54986713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC193OUTGET /rules/rule224901v11s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:31 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 2284
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BCD58BEEE"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b738acd5-401e-0067-1502-1709c2000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220431Z-1657d5bbd48xsz2nuzq4vfrzg800000005fg0000000089ug
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC2284INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        93192.168.2.54986813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:31 UTC192OUTGET /rules/rule701201v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:31 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1393
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE3E55B6E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 8a5fd43d-c01e-0066-4506-17a1ec000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220431Z-1657d5bbd48dfrdj7px744zp8s00000005a000000000ggb6
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC1393INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        94192.168.2.54986913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC192OUTGET /rules/rule701200v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:32 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1356
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDC681E17"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 0480ed94-801e-00ac-5102-17fd65000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220432Z-1657d5bbd48xlwdx82gahegw4000000005vg000000002zt4
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC1356INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        95192.168.2.54987013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC192OUTGET /rules/rule700201v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:32 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1393
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE39DFC9B"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b72ef555-401e-0067-78fe-1609c2000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220432Z-1657d5bbd48qjg85buwfdynm5w00000005s0000000003nbb
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC1393INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        96192.168.2.54987113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:32 UTC192OUTGET /rules/rule700200v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:34 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1356
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDF66E42D"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 8fccee85-001e-0028-6c95-19c49f000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220434Z-1657d5bbd48sdh4cyzadbb374800000005e000000000b7mv
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC1356INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        97192.168.2.54987313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC192OUTGET /rules/rule702350v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:34 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1358
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE6431446"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 84e7aa3f-c01e-008e-74ff-167381000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220434Z-1657d5bbd48brl8we3nu8cxwgn00000005u000000000sguz
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC1358INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        98192.168.2.54987213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC192OUTGET /rules/rule702351v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:34 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1395
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE017CAD3"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 5b983015-901e-005b-6d50-192005000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220434Z-1657d5bbd48tqvfc1ysmtbdrg000000005gg000000004fgk
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC1395INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        99192.168.2.54987413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC192OUTGET /rules/rule701251v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:34 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1395
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDE12A98D"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 03c3f781-101e-000b-56fe-165e5c000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220434Z-1657d5bbd48brl8we3nu8cxwgn00000005ug00000000rfn2
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC1395INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        100192.168.2.54987613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC192OUTGET /rules/rule701250v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1358
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE022ECC5"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 76165599-601e-000d-1a02-172618000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220435Z-1657d5bbd482krtfgrg72dfbtn00000005c0000000007bf2
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC1358INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        101192.168.2.54987713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:34 UTC192OUTGET /rules/rule700051v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:34 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1389
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE10A6BC1"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 29f28342-e01e-003c-5d00-17c70b000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220434Z-1657d5bbd48brl8we3nu8cxwgn00000005zg000000001z8y
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC1389INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        102192.168.2.54987813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC192OUTGET /rules/rule700050v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1352
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE9DEEE28"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: a9a45936-c01e-00a1-54f1-167e4a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220435Z-1657d5bbd48sqtlf1huhzuwq70000000058g00000000mtxg
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC1352INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        103192.168.2.54987913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC192OUTGET /rules/rule702951v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1405
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE12B5C71"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: c7b66cba-b01e-005c-04ff-164c66000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220435Z-1657d5bbd48cpbzgkvtewk0wu000000005ng00000000hu61
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC1405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        104192.168.2.56150313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC192OUTGET /rules/rule702950v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1368
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDDC22447"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 173e0f62-801e-00a3-24fe-167cfb000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220435Z-1657d5bbd48q6t9vvmrkd293mg00000005dg00000000z7p6
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC1368INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        105192.168.2.56150413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC192OUTGET /rules/rule701151v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1401
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE055B528"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 6bee43b5-001e-00a2-2106-17d4d5000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220435Z-1657d5bbd482tlqpvyz9e93p5400000005m000000000q1f0
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC1401INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        106192.168.2.56150613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC192OUTGET /rules/rule701150v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1364
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE1223606"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 04600955-801e-00ac-55f4-16fd65000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220435Z-1657d5bbd48tqvfc1ysmtbdrg000000005fg000000007xw1
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC1364INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                                                                                        107192.168.2.56150813.107.246.454437192C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:35 UTC192OUTGET /rules/rule702201v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:35 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1397
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE7262739"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 4035d6e2-a01e-0002-4602-175074000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220435Z-1657d5bbd48qjg85buwfdynm5w00000005k000000000xbvb
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        108192.168.2.56151413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC192OUTGET /rules/rule700401v2s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:36 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1403
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDCB4853F"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 87e26173-201e-0051-15e7-167340000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220436Z-1657d5bbd48vhs7r2p1ky7cs5w00000005y0000000007cey
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        109192.168.2.56151313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC192OUTGET /rules/rule702200v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:36 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1360
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDDEB5124"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 19d639b0-101e-0028-4caa-198f64000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220436Z-1657d5bbd48gjrh9ymem1nvr1n00000000xg00000000mqyg
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        110192.168.2.56151513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC192OUTGET /rules/rule700400v2s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:36 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1366
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDB779FC3"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 52963dc7-601e-0084-0e74-176b3f000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220436Z-1657d5bbd482lxwq1dp2t1zwkc00000005dg0000000023my
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        111192.168.2.56151613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC192OUTGET /rules/rule700351v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:36 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1397
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDFD43C07"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 664b7eb5-f01e-003f-41e6-18d19d000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220436Z-1657d5bbd48lknvp09v995n790000000052g0000000109ze
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:36 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        112192.168.2.56152213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC192OUTGET /rules/rule703901v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1427
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE56F6873"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 08bf7a15-f01e-0020-7706-17956b000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220437Z-1657d5bbd48gqrfwecymhhbfm800000004f00000000057gx
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC1427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        113192.168.2.56152113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC192OUTGET /rules/rule700350v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1360
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDD74D2EC"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: f076ebb2-f01e-001f-3766-175dc8000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220437Z-1657d5bbd48sdh4cyzadbb374800000005g0000000004320
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        114192.168.2.56152313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC192OUTGET /rules/rule703900v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1390
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE3002601"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 7d21ea5d-701e-0098-0502-17395f000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220437Z-1657d5bbd48762wn1qw4s5sd3000000005a000000001301a
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC1390INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        115192.168.2.56152413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC192OUTGET /rules/rule701501v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1401
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE2A9D541"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b6fa471e-401e-0067-43e5-1609c2000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220437Z-1657d5bbd482krtfgrg72dfbtn00000005ag00000000cs30
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:37 UTC1401INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        116192.168.2.56152613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC192OUTGET /rules/rule701500v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1364
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BEB6AD293"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 92f774e6-201e-00aa-73ab-193928000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220438Z-1657d5bbd48lknvp09v995n790000000055g00000000kcwm
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC1364INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        117192.168.2.56152713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC192OUTGET /rules/rule702801v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1391
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDF58DC7E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: a18d9b1d-601e-0002-1f03-17a786000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220438Z-1657d5bbd482tlqpvyz9e93p5400000005s0000000002w5k
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC1391INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        118192.168.2.56152813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC192OUTGET /rules/rule702800v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1354
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE0662D7C"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: d4fd285a-d01e-005a-06ed-167fd9000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220438Z-1657d5bbd48vlsxxpe15ac3q7n00000005g000000000p7ce
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC1354INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        119192.168.2.56152913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC192OUTGET /rules/rule703351v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1403
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDCDD6400"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 1eaf42aa-001e-0014-79db-185151000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220438Z-1657d5bbd48tqvfc1ysmtbdrg000000005b000000000vdz6
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        120192.168.2.56153013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC192OUTGET /rules/rule703350v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1366
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDF1E2608"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: c9f5ea47-201e-0071-33fe-16ff15000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220438Z-1657d5bbd482tlqpvyz9e93p5400000005n000000000hf2v
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:38 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        121192.168.2.56153413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule701801v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1403
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDC2EEE03"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 013451e4-b01e-001e-58e7-180214000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd48jwrqbupe3ktsx9w00000005sg00000000genr
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        122192.168.2.56153113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule703501v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1399
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE8C605FF"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 5e4eebc4-501e-007b-7950-195ba2000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd48q6t9vvmrkd293mg00000005mg000000006k6r
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        123192.168.2.56153213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule703500v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1362
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDF497570"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 838d785c-001e-0014-24fe-165151000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd48lknvp09v995n790000000053000000000za7y
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        124192.168.2.56153313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule701800v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1366
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BEA414B16"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 8a56303a-c01e-0066-0f01-17a1ec000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd48xdq5dkwwugdpzr000000005z00000000044fd
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        125192.168.2.56153513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule701051v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1399
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE1CC18CD"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: cd0b82ba-d01e-0049-1304-17e7dc000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd48xdq5dkwwugdpzr000000005w000000000hg3x
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        126192.168.2.56153813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule702750v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1366
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE5B7B174"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 5e525792-501e-007b-5e51-195ba2000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd487nf59mzf5b3gk8n0000000590000000004wvg
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        127192.168.2.56153713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule701050v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1362
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BEB256F43"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: d5204305-601e-003e-4ea3-193248000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd48gjrh9ymem1nvr1n00000000yg00000000fbu1
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        128192.168.2.56153913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule702301v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1399
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE976026E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 4d8e59a4-701e-0021-64fe-163d45000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd482lxwq1dp2t1zwkc000000057000000000xkkn
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        129192.168.2.56154013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule702300v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1362
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDC13EFEF"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 4ef38422-401e-000a-160c-174a7b000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd48tnj6wmberkg2xy800000005kg00000000tv67
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        130192.168.2.56153613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC192OUTGET /rules/rule702751v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1403
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BEB866CDB"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: d3a3eb01-b01e-003d-1ef1-16d32c000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220439Z-1657d5bbd48vhs7r2p1ky7cs5w00000005vg00000000hmb7
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:39 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        131192.168.2.56154413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC192OUTGET /rules/rule702500v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1378
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDB813B3F"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 87e265fd-201e-0051-4fe7-167340000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220440Z-1657d5bbd48tnj6wmberkg2xy800000005pg00000000c4r1
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC1378INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        132192.168.2.56154213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC192OUTGET /rules/rule703400v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1388
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDBD9126E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 75ef523f-601e-000d-02f2-162618000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220440Z-1657d5bbd48xsz2nuzq4vfrzg800000005ag00000000z6wp
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC1388INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        133192.168.2.56154313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC192OUTGET /rules/rule702501v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1415
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE7C66E85"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: f8d52bc7-f01e-001f-0156-195dc8000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220440Z-1657d5bbd48xjgsr3pyv9u71rc00000001hg00000000grve
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC1415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        134192.168.2.56154113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC192OUTGET /rules/rule703401v0s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1425
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE6BD89A1"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 90f3b6c7-701e-0053-4ce6-183a0a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220440Z-1657d5bbd48jwrqbupe3ktsx9w00000005pg00000000y96h
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC1425INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        135192.168.2.56154513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC192OUTGET /rules/rule700501v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:40 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1405
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE89A8F82"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: c9f5e5fc-201e-0071-5dfe-16ff15000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220440Z-1657d5bbd487nf59mzf5b3gk8n000000055000000000pc1u
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:40 UTC1405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        136192.168.2.56154713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC192OUTGET /rules/rule702551v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1415
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDCE9703A"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: c7bef06d-501e-00a0-4fe6-189d9f000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220441Z-1657d5bbd48vhs7r2p1ky7cs5w00000005t000000000whwu
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC1415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        137192.168.2.56154913.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC192OUTGET /rules/rule701351v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1407
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE687B46A"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 20e89b60-501e-008c-3a03-17cd39000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220441Z-1657d5bbd48vhs7r2p1ky7cs5w00000005yg000000005f62
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC1407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        138192.168.2.56154613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC192OUTGET /rules/rule700500v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1368
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE51CE7B3"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 3e7839e3-701e-0053-5cff-163a0a000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220441Z-1657d5bbd487nf59mzf5b3gk8n000000055g00000000kpgg
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC1368INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        139192.168.2.56154813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC192OUTGET /rules/rule702550v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1378
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE584C214"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: dfa7567c-f01e-003f-67de-16d19d000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220441Z-1657d5bbd48tnj6wmberkg2xy800000005p000000000edcv
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC1378INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        140192.168.2.56155013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC192OUTGET /rules/rule701350v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1370
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BDE62E0AB"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 838d7376-001e-0014-17fe-165151000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220441Z-1657d5bbd48brl8we3nu8cxwgn00000005y0000000008fh0
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:41 UTC1370INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        141192.168.2.56155113.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC192OUTGET /rules/rule702151v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1397
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE156D2EE"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 7d18055e-701e-0098-56ff-16395f000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220442Z-1657d5bbd48762wn1qw4s5sd3000000005e000000000ehb2
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        142192.168.2.56155213.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC192OUTGET /rules/rule702150v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1360
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BEDC8193E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: b1fbfe33-a01e-003d-4fd4-1698d7000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220442Z-1657d5bbd48q6t9vvmrkd293mg00000005dg00000000z7wu
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        143192.168.2.56155313.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC192OUTGET /rules/rule703001v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1406
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BEB16F27E"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 770fdf22-501e-0035-0d02-17c923000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220442Z-1657d5bbd48xlwdx82gahegw4000000005vg0000000030pk
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC1406INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        144192.168.2.56155513.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC192OUTGET /rules/rule700751v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1414
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE03B051D"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 00f6304a-401e-0048-48ef-180409000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220442Z-1657d5bbd48lknvp09v995n790000000053g00000000wf2d
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC1414INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        145192.168.2.56155413.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC192OUTGET /rules/rule703000v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:42 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1369
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE32FE1A2"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: caf96bab-201e-003f-1de0-186d94000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220442Z-1657d5bbd48lknvp09v995n790000000056g00000000etxa
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:42 UTC1369INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        146192.168.2.56155613.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC192OUTGET /rules/rule700750v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1377
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BEAFF0125"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: fba86ca6-e01e-00aa-5200-17ceda000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220443Z-1657d5bbd48xsz2nuzq4vfrzg800000005a00000000117q8
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC1377INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        147192.168.2.56155713.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC192OUTGET /rules/rule700151v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1399
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE0A2434F"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 93d7690b-001e-0066-17e6-18561e000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220443Z-1657d5bbd48xsz2nuzq4vfrzg800000005eg00000000czhg
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        148192.168.2.56155813.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC192OUTGET /rules/rule700150v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1362
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE54CA33F"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 85329464-c01e-0034-6acc-162af6000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220443Z-1657d5bbd48vhs7r2p1ky7cs5w00000005t000000000wk11
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">


                                                                                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                                                                                                                                        149192.168.2.56156013.107.246.45443
                                                                                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC192OUTGET /rules/rule703450v1s19.xml HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip
                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                                                                                                                                                                                                                                                                                                                                        Host: otelrules.azureedge.net
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC563INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                        Date: Tue, 08 Oct 2024 22:04:43 GMT
                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                                                                                                                                                                                                                                        Content-Length: 1372
                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                                                                                        Cache-Control: public, max-age=604800, immutable
                                                                                                                                                                                                                                                                                                                                                                        Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT
                                                                                                                                                                                                                                                                                                                                                                        ETag: "0x8DC582BE6669CA7"
                                                                                                                                                                                                                                                                                                                                                                        x-ms-request-id: 9139889b-001e-0079-22f3-1612e8000000
                                                                                                                                                                                                                                                                                                                                                                        x-ms-version: 2018-03-28
                                                                                                                                                                                                                                                                                                                                                                        x-azure-ref: 20241008T220443Z-1657d5bbd48vhs7r2p1ky7cs5w00000005tg00000000u74q
                                                                                                                                                                                                                                                                                                                                                                        x-fd-int-roxy-purgeid: 0
                                                                                                                                                                                                                                                                                                                                                                        X-Cache: TCP_HIT
                                                                                                                                                                                                                                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                        2024-10-08 22:04:43 UTC1372INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c
                                                                                                                                                                                                                                                                                                                                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <


                                                                                                                                                                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:03:58
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\file.exe"
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0xc0000
                                                                                                                                                                                                                                                                                                                                                                        File size:919'040 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:008D4C1CDB9B763E867F32CE0E5219BE
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000000.00000003.2053297015.00000000015C3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000000.00000002.3303862059.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:1
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:03:58
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM firefox.exe /T
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:03:59
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:01
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM chrome.exe /T
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:5
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:01
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:6
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:01
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM msedge.exe /T
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:7
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:01
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:8
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:02
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM opera.exe /T
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:02
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:10
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:02
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM brave.exe /T
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:02
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:02
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:02
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:02
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:03
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2116 -prefMapHandle 2088 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6173e676-c43b-4cb8-a736-2d8aff0db5d2} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c864f6f710 socket
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:17
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:05
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM msedge.exe /T
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:05
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:06
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM opera.exe /T
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:06
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:07
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM brave.exe /T
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:22
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:07
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:07
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4484 -parentBuildID 20230927232528 -prefsHandle 4212 -prefMapHandle 4428 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8da78f2-518e-408c-bcad-9b17924570ea} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c864f7b310 rdd
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:08
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff715980000
                                                                                                                                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:09
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff715980000
                                                                                                                                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:21
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5440 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff715980000
                                                                                                                                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:21
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 --field-trial-handle=1984,i,2093774086351915110,5777851306504175227,262144 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff715980000
                                                                                                                                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                                                                                        Target ID:29
                                                                                                                                                                                                                                                                                                                                                                        Start time:18:04:23
                                                                                                                                                                                                                                                                                                                                                                        Start date:08/10/2024
                                                                                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4964 -prefMapHandle 3712 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c73dd90-851d-4d9d-9772-142af10aaa4f} 7724 "\\.\pipe\gecko-crash-server-pipe.7724" 1c87e79d710 utility
                                                                                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                                                                                                                                                          Execution Coverage:2.1%
                                                                                                                                                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                                                                                                                          Signature Coverage:4.5%
                                                                                                                                                                                                                                                                                                                                                                          Total number of Nodes:1840
                                                                                                                                                                                                                                                                                                                                                                          Total number of Limit Nodes:83
                                                                                                                                                                                                                                                                                                                                                                          execution_graph 96879 152a55 96887 131ebc 96879->96887 96882 152a87 96883 152a70 96889 1239c0 22 API calls 96883->96889 96885 152a7c 96890 12417d 22 API calls __fread_nolock 96885->96890 96888 131ec3 IsWindow 96887->96888 96888->96882 96888->96883 96889->96885 96890->96882 96891 c1cad SystemParametersInfoW 96892 113f75 96903 dceb1 96892->96903 96894 113f8b 96895 114006 96894->96895 96970 de300 23 API calls 96894->96970 96912 cbf40 96895->96912 96898 114052 96902 114a88 96898->96902 96972 13359c 82 API calls __wsopen_s 96898->96972 96900 113fe6 96900->96898 96971 131abf 22 API calls 96900->96971 96904 dcebf 96903->96904 96905 dced2 96903->96905 96973 caceb 96904->96973 96907 dcf05 96905->96907 96908 dced7 96905->96908 96910 caceb 23 API calls 96907->96910 96983 dfddb 96908->96983 96911 dcec9 96910->96911 96911->96894 97007 cadf0 96912->97007 96914 cbf9d 96915 cbfa9 96914->96915 96916 1104b6 96914->96916 96918 cc01e 96915->96918 96919 1104c6 96915->96919 97035 13359c 82 API calls __wsopen_s 96916->97035 97012 cac91 96918->97012 97036 13359c 82 API calls __wsopen_s 96919->97036 96923 127120 22 API calls 96952 cc039 ISource __fread_nolock 96923->96952 96924 cc7da 97024 dfe0b 96924->97024 96929 1104f5 96933 11055a 96929->96933 97037 dd217 438 API calls 96929->97037 96932 cc808 __fread_nolock 96935 dfe0b 22 API calls 96932->96935 96959 cc603 96933->96959 97038 13359c 82 API calls __wsopen_s 96933->97038 96934 cec40 438 API calls 96934->96952 96940 cc350 ISource __fread_nolock 96935->96940 96936 caf8a 22 API calls 96936->96952 96937 11091a 97071 133209 23 API calls 96937->97071 96953 cc3ac 96940->96953 97034 dce17 22 API calls ISource 96940->97034 96941 1108a5 97045 cec40 96941->97045 96943 1108cf 96943->96959 97069 ca81b 41 API calls 96943->97069 96945 110591 97039 13359c 82 API calls __wsopen_s 96945->97039 96949 1108f6 97070 13359c 82 API calls __wsopen_s 96949->97070 96951 cbbe0 40 API calls 96951->96952 96952->96923 96952->96924 96952->96929 96952->96932 96952->96933 96952->96934 96952->96936 96952->96937 96952->96941 96952->96945 96952->96949 96952->96951 96955 caceb 23 API calls 96952->96955 96956 cc237 96952->96956 96957 dfddb 22 API calls 96952->96957 96952->96959 96965 1109bf 96952->96965 96969 dfe0b 22 API calls 96952->96969 97016 cad81 96952->97016 97040 127099 22 API calls __fread_nolock 96952->97040 97041 145745 54 API calls _wcslen 96952->97041 97042 daa42 22 API calls ISource 96952->97042 97043 12f05c 40 API calls 96952->97043 97044 ca993 41 API calls 96952->97044 96953->96898 96954 cc253 96960 110976 96954->96960 96963 cc297 ISource 96954->96963 96955->96952 96956->96954 97072 ca8c7 22 API calls __fread_nolock 96956->97072 96957->96952 96959->96898 96962 caceb 23 API calls 96960->96962 96962->96965 96964 caceb 23 API calls 96963->96964 96963->96965 96966 cc335 96964->96966 96965->96959 97073 13359c 82 API calls __wsopen_s 96965->97073 96966->96965 96967 cc342 96966->96967 97023 ca704 22 API calls ISource 96967->97023 96969->96952 96970->96900 96971->96895 96972->96902 96974 cacf9 96973->96974 96982 cad2a ISource 96973->96982 96975 cad55 96974->96975 96977 cad01 ISource 96974->96977 96975->96982 96993 ca8c7 22 API calls __fread_nolock 96975->96993 96978 10fa48 96977->96978 96979 cad21 96977->96979 96977->96982 96978->96982 96994 dce17 22 API calls ISource 96978->96994 96980 10fa3a VariantClear 96979->96980 96979->96982 96980->96982 96982->96911 96984 dfde0 96983->96984 96986 dfdfa 96984->96986 96989 dfdfc 96984->96989 96995 eea0c 96984->96995 97002 e4ead 7 API calls 2 library calls 96984->97002 96986->96911 96988 e066d 97004 e32a4 RaiseException 96988->97004 96989->96988 97003 e32a4 RaiseException 96989->97003 96991 e068a 96991->96911 96993->96982 96994->96982 97000 f3820 _free 96995->97000 96996 f385e 97006 ef2d9 20 API calls _free 96996->97006 96997 f3849 RtlAllocateHeap 96999 f385c 96997->96999 96997->97000 96999->96984 97000->96996 97000->96997 97005 e4ead 7 API calls 2 library calls 97000->97005 97002->96984 97003->96988 97004->96991 97005->97000 97006->96999 97008 cae01 97007->97008 97011 cae1c ISource 97007->97011 97074 caec9 97008->97074 97010 cae09 CharUpperBuffW 97010->97011 97011->96914 97013 cacae 97012->97013 97015 cacd1 97013->97015 97080 13359c 82 API calls __wsopen_s 97013->97080 97015->96952 97017 10fadb 97016->97017 97018 cad92 97016->97018 97019 dfddb 22 API calls 97018->97019 97020 cad99 97019->97020 97081 cadcd 97020->97081 97023->96940 97025 dfddb 97024->97025 97026 eea0c ___std_exception_copy 21 API calls 97025->97026 97027 dfdfa 97025->97027 97030 dfdfc 97025->97030 97094 e4ead 7 API calls 2 library calls 97025->97094 97026->97025 97027->96932 97029 e066d 97096 e32a4 RaiseException 97029->97096 97030->97029 97095 e32a4 RaiseException 97030->97095 97032 e068a 97032->96932 97034->96940 97035->96919 97036->96959 97037->96933 97038->96959 97039->96959 97040->96952 97041->96952 97042->96952 97043->96952 97044->96952 97066 cec76 ISource 97045->97066 97046 e0242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 97046->97066 97047 dfddb 22 API calls 97047->97066 97049 cfef7 97061 ced9d ISource 97049->97061 97100 ca8c7 22 API calls __fread_nolock 97049->97100 97051 114600 97051->97061 97099 ca8c7 22 API calls __fread_nolock 97051->97099 97052 114b0b 97102 13359c 82 API calls __wsopen_s 97052->97102 97053 ca8c7 22 API calls 97053->97066 97059 cfbe3 97059->97061 97062 114bdc 97059->97062 97068 cf3ae ISource 97059->97068 97060 ca961 22 API calls 97060->97066 97061->96943 97103 13359c 82 API calls __wsopen_s 97062->97103 97063 e00a3 29 API calls pre_c_initialization 97063->97066 97065 114beb 97104 13359c 82 API calls __wsopen_s 97065->97104 97066->97046 97066->97047 97066->97049 97066->97051 97066->97052 97066->97053 97066->97059 97066->97060 97066->97061 97066->97063 97066->97065 97067 e01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 97066->97067 97066->97068 97097 d01e0 438 API calls 2 library calls 97066->97097 97098 d06a0 41 API calls ISource 97066->97098 97067->97066 97068->97061 97101 13359c 82 API calls __wsopen_s 97068->97101 97069->96949 97070->96959 97071->96956 97072->96954 97073->96959 97075 caedc 97074->97075 97076 caed9 __fread_nolock 97074->97076 97077 dfddb 22 API calls 97075->97077 97076->97010 97078 caee7 97077->97078 97079 dfe0b 22 API calls 97078->97079 97079->97076 97080->97015 97085 caddd 97081->97085 97082 cadb6 97082->96952 97083 dfddb 22 API calls 97083->97085 97085->97082 97085->97083 97087 cadcd 22 API calls 97085->97087 97088 ca961 97085->97088 97093 ca8c7 22 API calls __fread_nolock 97085->97093 97087->97085 97089 dfe0b 22 API calls 97088->97089 97090 ca976 97089->97090 97091 dfddb 22 API calls 97090->97091 97092 ca984 97091->97092 97092->97085 97093->97085 97094->97025 97095->97029 97096->97032 97097->97066 97098->97066 97099->97061 97100->97061 97101->97061 97102->97061 97103->97065 97104->97061 97105 c1044 97110 c10f3 97105->97110 97107 c104a 97146 e00a3 29 API calls __onexit 97107->97146 97109 c1054 97147 c1398 97110->97147 97114 c116a 97115 ca961 22 API calls 97114->97115 97116 c1174 97115->97116 97117 ca961 22 API calls 97116->97117 97118 c117e 97117->97118 97119 ca961 22 API calls 97118->97119 97120 c1188 97119->97120 97121 ca961 22 API calls 97120->97121 97122 c11c6 97121->97122 97123 ca961 22 API calls 97122->97123 97124 c1292 97123->97124 97157 c171c 97124->97157 97128 c12c4 97129 ca961 22 API calls 97128->97129 97130 c12ce 97129->97130 97178 d1940 97130->97178 97132 c12f9 97188 c1aab 97132->97188 97134 c1315 97135 c1325 GetStdHandle 97134->97135 97136 102485 97135->97136 97137 c137a 97135->97137 97136->97137 97138 10248e 97136->97138 97140 c1387 OleInitialize 97137->97140 97139 dfddb 22 API calls 97138->97139 97141 102495 97139->97141 97140->97107 97195 13011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 97141->97195 97143 10249e 97196 130944 CreateThread 97143->97196 97145 1024aa CloseHandle 97145->97137 97146->97109 97197 c13f1 97147->97197 97150 c13f1 22 API calls 97151 c13d0 97150->97151 97152 ca961 22 API calls 97151->97152 97153 c13dc 97152->97153 97204 c6b57 97153->97204 97155 c1129 97156 c1bc3 6 API calls 97155->97156 97156->97114 97158 ca961 22 API calls 97157->97158 97159 c172c 97158->97159 97160 ca961 22 API calls 97159->97160 97161 c1734 97160->97161 97162 ca961 22 API calls 97161->97162 97163 c174f 97162->97163 97164 dfddb 22 API calls 97163->97164 97165 c129c 97164->97165 97166 c1b4a 97165->97166 97167 c1b58 97166->97167 97168 ca961 22 API calls 97167->97168 97169 c1b63 97168->97169 97170 ca961 22 API calls 97169->97170 97171 c1b6e 97170->97171 97172 ca961 22 API calls 97171->97172 97173 c1b79 97172->97173 97174 ca961 22 API calls 97173->97174 97175 c1b84 97174->97175 97176 dfddb 22 API calls 97175->97176 97177 c1b96 RegisterWindowMessageW 97176->97177 97177->97128 97179 d1981 97178->97179 97183 d195d 97178->97183 97221 e0242 5 API calls __Init_thread_wait 97179->97221 97181 d198b 97181->97183 97222 e01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 97181->97222 97187 d196e 97183->97187 97223 e0242 5 API calls __Init_thread_wait 97183->97223 97184 d8727 97184->97187 97224 e01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 97184->97224 97187->97132 97189 c1abb 97188->97189 97190 10272d 97188->97190 97192 dfddb 22 API calls 97189->97192 97225 133209 23 API calls 97190->97225 97194 c1ac3 97192->97194 97193 102738 97194->97134 97195->97143 97196->97145 97226 13092a 28 API calls 97196->97226 97198 ca961 22 API calls 97197->97198 97199 c13fc 97198->97199 97200 ca961 22 API calls 97199->97200 97201 c1404 97200->97201 97202 ca961 22 API calls 97201->97202 97203 c13c6 97202->97203 97203->97150 97205 104ba1 97204->97205 97207 c6b67 _wcslen 97204->97207 97217 c93b2 97205->97217 97209 c6b7d 97207->97209 97210 c6ba2 97207->97210 97208 104baa 97208->97208 97216 c6f34 22 API calls 97209->97216 97211 dfddb 22 API calls 97210->97211 97213 c6bae 97211->97213 97215 dfe0b 22 API calls 97213->97215 97214 c6b85 __fread_nolock 97214->97155 97215->97214 97216->97214 97218 c93c0 97217->97218 97220 c93c9 __fread_nolock 97217->97220 97219 caec9 22 API calls 97218->97219 97218->97220 97219->97220 97220->97208 97221->97181 97222->97183 97223->97184 97224->97187 97225->97193 97227 f8402 97232 f81be 97227->97232 97230 f842a 97237 f81ef try_get_first_available_module 97232->97237 97234 f83ee 97251 f27ec 26 API calls __fread_nolock 97234->97251 97236 f8343 97236->97230 97244 100984 97236->97244 97237->97237 97240 f8338 97237->97240 97247 e8e0b 40 API calls 2 library calls 97237->97247 97239 f838c 97239->97240 97248 e8e0b 40 API calls 2 library calls 97239->97248 97240->97236 97250 ef2d9 20 API calls _free 97240->97250 97242 f83ab 97242->97240 97249 e8e0b 40 API calls 2 library calls 97242->97249 97252 100081 97244->97252 97246 10099f 97246->97230 97247->97239 97248->97242 97249->97240 97250->97234 97251->97236 97255 10008d CallCatchBlock 97252->97255 97253 10009b 97310 ef2d9 20 API calls _free 97253->97310 97255->97253 97257 1000d4 97255->97257 97256 1000a0 97311 f27ec 26 API calls __fread_nolock 97256->97311 97263 10065b 97257->97263 97262 1000aa __fread_nolock 97262->97246 97313 10042f 97263->97313 97266 1006a6 97331 f5221 97266->97331 97267 10068d 97345 ef2c6 20 API calls _free 97267->97345 97270 1006ab 97272 1006b4 97270->97272 97273 1006cb 97270->97273 97271 100692 97346 ef2d9 20 API calls _free 97271->97346 97347 ef2c6 20 API calls _free 97272->97347 97344 10039a CreateFileW 97273->97344 97277 1006b9 97348 ef2d9 20 API calls _free 97277->97348 97279 100781 GetFileType 97280 1007d3 97279->97280 97281 10078c GetLastError 97279->97281 97353 f516a 21 API calls 3 library calls 97280->97353 97351 ef2a3 20 API calls 2 library calls 97281->97351 97282 100756 GetLastError 97350 ef2a3 20 API calls 2 library calls 97282->97350 97285 100704 97285->97279 97285->97282 97349 10039a CreateFileW 97285->97349 97286 10079a CloseHandle 97286->97271 97288 1007c3 97286->97288 97352 ef2d9 20 API calls _free 97288->97352 97290 100749 97290->97279 97290->97282 97292 1007f4 97293 100840 97292->97293 97354 1005ab 72 API calls 4 library calls 97292->97354 97298 10086d 97293->97298 97355 10014d 72 API calls 4 library calls 97293->97355 97294 1007c8 97294->97271 97297 100866 97297->97298 97299 10087e 97297->97299 97356 f86ae 97298->97356 97301 1000f8 97299->97301 97302 1008fc CloseHandle 97299->97302 97312 100121 LeaveCriticalSection __wsopen_s 97301->97312 97371 10039a CreateFileW 97302->97371 97304 100927 97305 100931 GetLastError 97304->97305 97306 10095d 97304->97306 97372 ef2a3 20 API calls 2 library calls 97305->97372 97306->97301 97308 10093d 97373 f5333 21 API calls 3 library calls 97308->97373 97310->97256 97311->97262 97312->97262 97314 100450 97313->97314 97315 10046a 97313->97315 97314->97315 97381 ef2d9 20 API calls _free 97314->97381 97374 1003bf 97315->97374 97318 10045f 97382 f27ec 26 API calls __fread_nolock 97318->97382 97320 1004a2 97321 1004d1 97320->97321 97383 ef2d9 20 API calls _free 97320->97383 97326 100524 97321->97326 97385 ed70d 26 API calls 2 library calls 97321->97385 97324 10051f 97324->97326 97327 10059e 97324->97327 97325 1004c6 97384 f27ec 26 API calls __fread_nolock 97325->97384 97326->97266 97326->97267 97386 f27fc 11 API calls _abort 97327->97386 97330 1005aa 97332 f522d CallCatchBlock 97331->97332 97389 f2f5e EnterCriticalSection 97332->97389 97334 f5234 97336 f5259 97334->97336 97340 f52c7 EnterCriticalSection 97334->97340 97342 f527b 97334->97342 97393 f5000 97336->97393 97339 f52a4 __fread_nolock 97339->97270 97340->97342 97343 f52d4 LeaveCriticalSection 97340->97343 97390 f532a 97342->97390 97343->97334 97344->97285 97345->97271 97346->97301 97347->97277 97348->97271 97349->97290 97350->97271 97351->97286 97352->97294 97353->97292 97354->97293 97355->97297 97413 f53c4 97356->97413 97358 f86c4 97426 f5333 21 API calls 3 library calls 97358->97426 97359 f86be 97359->97358 97361 f86f6 97359->97361 97363 f53c4 __wsopen_s 26 API calls 97359->97363 97361->97358 97364 f53c4 __wsopen_s 26 API calls 97361->97364 97362 f871c 97365 f873e 97362->97365 97427 ef2a3 20 API calls 2 library calls 97362->97427 97366 f86ed 97363->97366 97367 f8702 CloseHandle 97364->97367 97365->97301 97370 f53c4 __wsopen_s 26 API calls 97366->97370 97367->97358 97368 f870e GetLastError 97367->97368 97368->97358 97370->97361 97371->97304 97372->97308 97373->97306 97375 1003d7 97374->97375 97376 1003f2 97375->97376 97387 ef2d9 20 API calls _free 97375->97387 97376->97320 97378 100416 97388 f27ec 26 API calls __fread_nolock 97378->97388 97380 100421 97380->97320 97381->97318 97382->97315 97383->97325 97384->97321 97385->97324 97386->97330 97387->97378 97388->97380 97389->97334 97401 f2fa6 LeaveCriticalSection 97390->97401 97392 f5331 97392->97339 97402 f4c7d 97393->97402 97395 f501f 97410 f29c8 20 API calls _free 97395->97410 97396 f5012 97396->97395 97409 f3405 11 API calls 2 library calls 97396->97409 97399 f5071 97399->97342 97400 f5147 EnterCriticalSection 97399->97400 97400->97342 97401->97392 97403 f4c8a _free 97402->97403 97404 f4cca 97403->97404 97405 f4cb5 RtlAllocateHeap 97403->97405 97411 e4ead 7 API calls 2 library calls 97403->97411 97412 ef2d9 20 API calls _free 97404->97412 97405->97403 97406 f4cc8 97405->97406 97406->97396 97409->97396 97410->97399 97411->97403 97412->97406 97414 f53e6 97413->97414 97415 f53d1 97413->97415 97419 f540b 97414->97419 97430 ef2c6 20 API calls _free 97414->97430 97428 ef2c6 20 API calls _free 97415->97428 97418 f53d6 97429 ef2d9 20 API calls _free 97418->97429 97419->97359 97420 f5416 97431 ef2d9 20 API calls _free 97420->97431 97422 f53de 97422->97359 97424 f541e 97432 f27ec 26 API calls __fread_nolock 97424->97432 97426->97362 97427->97365 97428->97418 97429->97422 97430->97420 97431->97424 97432->97422 97433 c2de3 97434 c2df0 __wsopen_s 97433->97434 97435 c2e09 97434->97435 97436 102c2b ___scrt_fastfail 97434->97436 97449 c3aa2 97435->97449 97438 102c47 GetOpenFileNameW 97436->97438 97440 102c96 97438->97440 97443 c6b57 22 API calls 97440->97443 97445 102cab 97443->97445 97445->97445 97446 c2e27 97477 c44a8 97446->97477 97506 101f50 97449->97506 97452 c3ace 97455 c6b57 22 API calls 97452->97455 97453 c3ae9 97512 ca6c3 97453->97512 97456 c3ada 97455->97456 97508 c37a0 97456->97508 97459 c2da5 97460 101f50 __wsopen_s 97459->97460 97461 c2db2 GetLongPathNameW 97460->97461 97462 c6b57 22 API calls 97461->97462 97463 c2dda 97462->97463 97464 c3598 97463->97464 97465 ca961 22 API calls 97464->97465 97466 c35aa 97465->97466 97467 c3aa2 23 API calls 97466->97467 97468 c35b5 97467->97468 97469 1032eb 97468->97469 97470 c35c0 97468->97470 97475 10330d 97469->97475 97530 dce60 41 API calls 97469->97530 97518 c515f 97470->97518 97476 c35df 97476->97446 97531 c4ecb 97477->97531 97480 103833 97553 132cf9 97480->97553 97482 c4ecb 94 API calls 97484 c44e1 97482->97484 97483 103848 97485 103869 97483->97485 97486 10384c 97483->97486 97484->97480 97487 c44e9 97484->97487 97491 dfe0b 22 API calls 97485->97491 97580 c4f39 97486->97580 97488 103854 97487->97488 97489 c44f5 97487->97489 97586 12da5a 82 API calls 97488->97586 97579 c940c 136 API calls 2 library calls 97489->97579 97496 1038ae 97491->97496 97494 c2e31 97495 103862 97495->97485 97498 103a5f 97496->97498 97503 c9cb3 22 API calls 97496->97503 97587 12967e 22 API calls __fread_nolock 97496->97587 97588 1295ad 42 API calls _wcslen 97496->97588 97589 130b5a 22 API calls 97496->97589 97590 ca4a1 22 API calls __fread_nolock 97496->97590 97591 c3ff7 22 API calls 97496->97591 97497 c4f39 68 API calls 97497->97498 97498->97497 97592 12989b 82 API calls __wsopen_s 97498->97592 97503->97496 97507 c3aaf GetFullPathNameW 97506->97507 97507->97452 97507->97453 97509 c37ae 97508->97509 97510 c93b2 22 API calls 97509->97510 97511 c2e12 97510->97511 97511->97459 97513 ca6dd 97512->97513 97517 ca6d0 97512->97517 97514 dfddb 22 API calls 97513->97514 97515 ca6e7 97514->97515 97516 dfe0b 22 API calls 97515->97516 97516->97517 97517->97456 97519 c516e 97518->97519 97523 c518f __fread_nolock 97518->97523 97522 dfe0b 22 API calls 97519->97522 97520 dfddb 22 API calls 97521 c35cc 97520->97521 97524 c35f3 97521->97524 97522->97523 97523->97520 97525 c3605 97524->97525 97529 c3624 __fread_nolock 97524->97529 97527 dfe0b 22 API calls 97525->97527 97526 dfddb 22 API calls 97528 c363b 97526->97528 97527->97529 97528->97476 97529->97526 97530->97469 97593 c4e90 LoadLibraryA 97531->97593 97536 c4ef6 LoadLibraryExW 97601 c4e59 LoadLibraryA 97536->97601 97537 103ccf 97538 c4f39 68 API calls 97537->97538 97540 103cd6 97538->97540 97542 c4e59 3 API calls 97540->97542 97544 103cde 97542->97544 97623 c50f5 40 API calls __fread_nolock 97544->97623 97545 c4f20 97545->97544 97546 c4f2c 97545->97546 97548 c4f39 68 API calls 97546->97548 97549 c44cd 97548->97549 97549->97480 97549->97482 97550 103cf5 97624 1328fe 27 API calls 97550->97624 97552 103d05 97554 132d15 97553->97554 97692 c511f 64 API calls 97554->97692 97556 132d29 97693 132e66 75 API calls 97556->97693 97558 132d3b 97577 132d3f 97558->97577 97694 c50f5 40 API calls __fread_nolock 97558->97694 97560 132d56 97695 c50f5 40 API calls __fread_nolock 97560->97695 97562 132d66 97696 c50f5 40 API calls __fread_nolock 97562->97696 97564 132d81 97697 c50f5 40 API calls __fread_nolock 97564->97697 97566 132d9c 97698 c511f 64 API calls 97566->97698 97568 132db3 97569 eea0c ___std_exception_copy 21 API calls 97568->97569 97570 132dba 97569->97570 97571 eea0c ___std_exception_copy 21 API calls 97570->97571 97572 132dc4 97571->97572 97699 c50f5 40 API calls __fread_nolock 97572->97699 97574 132dd8 97700 1328fe 27 API calls 97574->97700 97576 132dee 97576->97577 97701 1322ce 97576->97701 97577->97483 97579->97494 97581 c4f43 97580->97581 97583 c4f4a 97580->97583 97582 ee678 67 API calls 97581->97582 97582->97583 97584 c4f59 97583->97584 97585 c4f6a FreeLibrary 97583->97585 97584->97488 97585->97584 97586->97495 97587->97496 97588->97496 97589->97496 97590->97496 97591->97496 97592->97498 97594 c4ea8 GetProcAddress 97593->97594 97595 c4ec6 97593->97595 97596 c4eb8 97594->97596 97598 ee5eb 97595->97598 97596->97595 97597 c4ebf FreeLibrary 97596->97597 97597->97595 97625 ee52a 97598->97625 97600 c4eea 97600->97536 97600->97537 97602 c4e8d 97601->97602 97603 c4e6e GetProcAddress 97601->97603 97606 c4f80 97602->97606 97604 c4e7e 97603->97604 97604->97602 97605 c4e86 FreeLibrary 97604->97605 97605->97602 97607 dfe0b 22 API calls 97606->97607 97608 c4f95 97607->97608 97678 c5722 97608->97678 97610 c4fa1 __fread_nolock 97611 c50a5 97610->97611 97612 103d1d 97610->97612 97622 c4fdc 97610->97622 97681 c42a2 CreateStreamOnHGlobal 97611->97681 97689 13304d 74 API calls 97612->97689 97615 103d22 97690 c511f 64 API calls 97615->97690 97618 103d45 97691 c50f5 40 API calls __fread_nolock 97618->97691 97621 c506e ISource 97621->97545 97622->97615 97622->97621 97687 c50f5 40 API calls __fread_nolock 97622->97687 97688 c511f 64 API calls 97622->97688 97623->97550 97624->97552 97628 ee536 CallCatchBlock 97625->97628 97626 ee544 97650 ef2d9 20 API calls _free 97626->97650 97628->97626 97629 ee574 97628->97629 97631 ee579 97629->97631 97632 ee586 97629->97632 97630 ee549 97651 f27ec 26 API calls __fread_nolock 97630->97651 97652 ef2d9 20 API calls _free 97631->97652 97642 f8061 97632->97642 97636 ee58f 97637 ee595 97636->97637 97639 ee5a2 97636->97639 97653 ef2d9 20 API calls _free 97637->97653 97654 ee5d4 LeaveCriticalSection __fread_nolock 97639->97654 97641 ee554 __fread_nolock 97641->97600 97643 f806d CallCatchBlock 97642->97643 97655 f2f5e EnterCriticalSection 97643->97655 97645 f807b 97656 f80fb 97645->97656 97649 f80ac __fread_nolock 97649->97636 97650->97630 97651->97641 97652->97641 97653->97641 97654->97641 97655->97645 97664 f811e 97656->97664 97657 f8177 97658 f4c7d _free 20 API calls 97657->97658 97659 f8180 97658->97659 97674 f29c8 20 API calls _free 97659->97674 97662 f8189 97665 f8088 97662->97665 97675 f3405 11 API calls 2 library calls 97662->97675 97664->97657 97664->97665 97672 e918d EnterCriticalSection 97664->97672 97673 e91a1 LeaveCriticalSection 97664->97673 97669 f80b7 97665->97669 97666 f81a8 97676 e918d EnterCriticalSection 97666->97676 97677 f2fa6 LeaveCriticalSection 97669->97677 97671 f80be 97671->97649 97672->97664 97673->97664 97674->97662 97675->97666 97676->97665 97677->97671 97679 dfddb 22 API calls 97678->97679 97680 c5734 97679->97680 97680->97610 97682 c42bc FindResourceExW 97681->97682 97683 c42d9 97681->97683 97682->97683 97684 1035ba LoadResource 97682->97684 97683->97622 97684->97683 97685 1035cf SizeofResource 97684->97685 97685->97683 97686 1035e3 LockResource 97685->97686 97686->97683 97687->97622 97688->97622 97689->97615 97690->97618 97691->97621 97692->97556 97693->97558 97694->97560 97695->97562 97696->97564 97697->97566 97698->97568 97699->97574 97700->97576 97702 1322d9 97701->97702 97703 1322e7 97701->97703 97704 ee5eb 29 API calls 97702->97704 97705 13232c 97703->97705 97706 ee5eb 29 API calls 97703->97706 97717 1322f0 97703->97717 97704->97703 97730 132557 40 API calls __fread_nolock 97705->97730 97707 132311 97706->97707 97707->97705 97710 13231a 97707->97710 97709 132370 97711 132395 97709->97711 97712 132374 97709->97712 97710->97717 97738 ee678 97710->97738 97731 132171 97711->97731 97713 132381 97712->97713 97716 ee678 67 API calls 97712->97716 97713->97717 97719 ee678 67 API calls 97713->97719 97716->97713 97717->97577 97718 13239d 97720 1323c3 97718->97720 97723 1323a3 97718->97723 97719->97717 97751 1323f3 74 API calls 97720->97751 97722 1323b0 97722->97717 97725 ee678 67 API calls 97722->97725 97723->97722 97724 ee678 67 API calls 97723->97724 97724->97722 97725->97717 97726 1323ca 97727 1323de 97726->97727 97728 ee678 67 API calls 97726->97728 97727->97717 97729 ee678 67 API calls 97727->97729 97728->97727 97729->97717 97730->97709 97732 eea0c ___std_exception_copy 21 API calls 97731->97732 97733 13217f 97732->97733 97734 eea0c ___std_exception_copy 21 API calls 97733->97734 97735 132190 97734->97735 97736 eea0c ___std_exception_copy 21 API calls 97735->97736 97737 13219c 97736->97737 97737->97718 97739 ee684 CallCatchBlock 97738->97739 97740 ee6aa 97739->97740 97741 ee695 97739->97741 97750 ee6a5 __fread_nolock 97740->97750 97752 e918d EnterCriticalSection 97740->97752 97769 ef2d9 20 API calls _free 97741->97769 97744 ee69a 97770 f27ec 26 API calls __fread_nolock 97744->97770 97745 ee6c6 97753 ee602 97745->97753 97748 ee6d1 97771 ee6ee LeaveCriticalSection __fread_nolock 97748->97771 97750->97717 97751->97726 97752->97745 97754 ee60f 97753->97754 97755 ee624 97753->97755 97804 ef2d9 20 API calls _free 97754->97804 97759 ee61f 97755->97759 97772 edc0b 97755->97772 97758 ee614 97805 f27ec 26 API calls __fread_nolock 97758->97805 97759->97748 97765 ee646 97789 f862f 97765->97789 97769->97744 97770->97750 97771->97750 97773 edc23 97772->97773 97774 edc1f 97772->97774 97773->97774 97775 ed955 __fread_nolock 26 API calls 97773->97775 97778 f4d7a 97774->97778 97776 edc43 97775->97776 97807 f59be 62 API calls 5 library calls 97776->97807 97779 ee640 97778->97779 97780 f4d90 97778->97780 97782 ed955 97779->97782 97780->97779 97808 f29c8 20 API calls _free 97780->97808 97783 ed976 97782->97783 97784 ed961 97782->97784 97783->97765 97809 ef2d9 20 API calls _free 97784->97809 97786 ed966 97810 f27ec 26 API calls __fread_nolock 97786->97810 97788 ed971 97788->97765 97790 f863e 97789->97790 97791 f8653 97789->97791 97814 ef2c6 20 API calls _free 97790->97814 97792 f868e 97791->97792 97797 f867a 97791->97797 97816 ef2c6 20 API calls _free 97792->97816 97794 f8643 97815 ef2d9 20 API calls _free 97794->97815 97811 f8607 97797->97811 97798 f8693 97817 ef2d9 20 API calls _free 97798->97817 97801 ee64c 97801->97759 97806 f29c8 20 API calls _free 97801->97806 97802 f869b 97818 f27ec 26 API calls __fread_nolock 97802->97818 97804->97758 97805->97759 97806->97759 97807->97774 97808->97779 97809->97786 97810->97788 97819 f8585 97811->97819 97813 f862b 97813->97801 97814->97794 97815->97801 97816->97798 97817->97802 97818->97801 97820 f8591 CallCatchBlock 97819->97820 97830 f5147 EnterCriticalSection 97820->97830 97822 f859f 97823 f85c6 97822->97823 97824 f85d1 97822->97824 97825 f86ae __wsopen_s 29 API calls 97823->97825 97831 ef2d9 20 API calls _free 97824->97831 97827 f85cc 97825->97827 97832 f85fb LeaveCriticalSection __wsopen_s 97827->97832 97829 f85ee __fread_nolock 97829->97813 97830->97822 97831->97827 97832->97829 97833 cdefc 97836 c1d6f 97833->97836 97835 cdf07 97837 c1d8c 97836->97837 97845 c1f6f 97837->97845 97839 c1da6 97840 102759 97839->97840 97842 c1e36 97839->97842 97844 c1dc2 97839->97844 97849 13359c 82 API calls __wsopen_s 97840->97849 97842->97835 97844->97842 97848 c289a 23 API calls 97844->97848 97846 cec40 438 API calls 97845->97846 97847 c1f98 97846->97847 97847->97839 97848->97842 97849->97842 97850 cdddc 97853 cb710 97850->97853 97854 cb72b 97853->97854 97855 110146 97854->97855 97856 1100f8 97854->97856 97876 cb750 97854->97876 97895 1458a2 438 API calls 2 library calls 97855->97895 97859 110102 97856->97859 97862 11010f 97856->97862 97856->97876 97893 145d33 438 API calls 97859->97893 97875 cba20 97862->97875 97894 1461d0 438 API calls 2 library calls 97862->97894 97864 dd336 40 API calls 97864->97876 97867 1103d9 97867->97867 97869 cba4e 97871 110322 97898 145c0c 82 API calls 97871->97898 97875->97869 97899 13359c 82 API calls __wsopen_s 97875->97899 97876->97864 97876->97869 97876->97871 97876->97875 97879 caceb 23 API calls 97876->97879 97880 cbbe0 40 API calls 97876->97880 97881 cec40 438 API calls 97876->97881 97884 ca81b 41 API calls 97876->97884 97885 dd2f0 40 API calls 97876->97885 97886 da01b 438 API calls 97876->97886 97887 e0242 5 API calls __Init_thread_wait 97876->97887 97888 dedcd 22 API calls 97876->97888 97889 e00a3 29 API calls __onexit 97876->97889 97890 e01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 97876->97890 97891 dee53 82 API calls 97876->97891 97892 de5ca 438 API calls 97876->97892 97896 11f6bf 23 API calls 97876->97896 97897 ca8c7 22 API calls __fread_nolock 97876->97897 97879->97876 97880->97876 97881->97876 97884->97876 97885->97876 97886->97876 97887->97876 97888->97876 97889->97876 97890->97876 97891->97876 97892->97876 97893->97862 97894->97875 97895->97876 97896->97876 97897->97876 97898->97875 97899->97867 97900 112a00 97906 cd7b0 ISource 97900->97906 97901 cd9d5 97902 cdb11 PeekMessageW 97902->97906 97903 cd807 GetInputState 97903->97902 97903->97906 97904 111cbe TranslateAcceleratorW 97904->97906 97906->97901 97906->97902 97906->97903 97906->97904 97907 cdb8f PeekMessageW 97906->97907 97908 cda04 timeGetTime 97906->97908 97909 cdb73 TranslateMessage DispatchMessageW 97906->97909 97910 cdbaf Sleep 97906->97910 97911 112b74 Sleep 97906->97911 97912 112a51 97906->97912 97915 111dda timeGetTime 97906->97915 97927 cec40 438 API calls 97906->97927 97930 cbf40 438 API calls 97906->97930 97932 cdd50 97906->97932 97939 d1310 97906->97939 97995 dedf6 97906->97995 98000 cdfd0 438 API calls 3 library calls 97906->98000 98001 de551 timeGetTime 97906->98001 98003 133a2a 23 API calls 97906->98003 98004 13359c 82 API calls __wsopen_s 97906->98004 97907->97906 97908->97906 97909->97907 97910->97906 97911->97912 97912->97901 97912->97906 97918 112c0b GetExitCodeProcess 97912->97918 97919 1529bf GetForegroundWindow 97912->97919 97923 112ca9 Sleep 97912->97923 98005 145658 23 API calls 97912->98005 98006 12e97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 97912->98006 98007 de551 timeGetTime 97912->98007 98008 12d4dc CreateToolhelp32Snapshot Process32FirstW 97912->98008 98002 de300 23 API calls 97915->98002 97921 112c21 WaitForSingleObject 97918->97921 97922 112c37 CloseHandle 97918->97922 97919->97912 97921->97906 97921->97922 97922->97912 97923->97906 97927->97906 97930->97906 97933 cdd6f 97932->97933 97934 cdd83 97932->97934 98018 cd260 97933->98018 98050 13359c 82 API calls __wsopen_s 97934->98050 97936 cdd7a 97936->97906 97938 112f75 97938->97938 97940 d1376 97939->97940 97941 d17b0 97939->97941 97942 116331 97940->97942 97944 d1940 9 API calls 97940->97944 98103 e0242 5 API calls __Init_thread_wait 97941->98103 98113 14709c 438 API calls 97942->98113 97947 d13a0 97944->97947 97946 d17ba 97949 d17fb 97946->97949 98104 c9cb3 97946->98104 97951 d1940 9 API calls 97947->97951 97948 11633d 97948->97906 97953 116346 97949->97953 97955 d182c 97949->97955 97952 d13b6 97951->97952 97952->97949 97954 d13ec 97952->97954 98114 13359c 82 API calls __wsopen_s 97953->98114 97954->97953 97979 d1408 __fread_nolock 97954->97979 97957 caceb 23 API calls 97955->97957 97959 d1839 97957->97959 97958 d17d4 98110 e01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 97958->98110 98111 dd217 438 API calls 97959->98111 97962 11636e 98115 13359c 82 API calls __wsopen_s 97962->98115 97963 d152f 97965 1163d1 97963->97965 97966 d153c 97963->97966 98117 145745 54 API calls _wcslen 97965->98117 97968 d1940 9 API calls 97966->97968 97969 d1549 97968->97969 97975 d1940 9 API calls 97969->97975 97985 d15c7 ISource 97969->97985 97970 dfddb 22 API calls 97970->97979 97971 d1872 97971->97942 98112 dfaeb 23 API calls 97971->98112 97972 dfe0b 22 API calls 97972->97979 97973 d171d 97973->97906 97982 d1563 97975->97982 97977 cec40 438 API calls 97977->97979 97978 d167b ISource 97978->97973 98102 dce17 22 API calls ISource 97978->98102 97979->97959 97979->97962 97979->97963 97979->97970 97979->97972 97979->97977 97983 1163b2 97979->97983 97979->97985 97980 d1940 9 API calls 97980->97985 97982->97985 98118 ca8c7 22 API calls __fread_nolock 97982->98118 98116 13359c 82 API calls __wsopen_s 97983->98116 97985->97971 97985->97978 97985->97980 98057 151591 97985->98057 98060 135c5a 97985->98060 98065 1507dc 97985->98065 98079 14ab67 97985->98079 98082 14a2ea 97985->98082 98087 14abf7 97985->98087 98092 1519bc 97985->98092 98095 df645 97985->98095 98119 13359c 82 API calls __wsopen_s 97985->98119 97996 dee09 97995->97996 97997 dee12 97995->97997 97996->97906 97997->97996 97998 dee36 IsDialogMessageW 97997->97998 97999 11efaf GetClassLongW 97997->97999 97998->97996 97998->97997 97999->97997 97999->97998 98000->97906 98001->97906 98002->97906 98003->97906 98004->97906 98005->97912 98006->97912 98007->97912 98696 12def7 98008->98696 98010 12d522 98011 12d5db CloseHandle 98010->98011 98012 12d529 Process32NextW 98010->98012 98013 ca961 22 API calls 98010->98013 98014 c9cb3 22 API calls 98010->98014 98702 c525f 22 API calls 98010->98702 98703 c6350 22 API calls 98010->98703 98704 dce60 41 API calls 98010->98704 98011->97912 98012->98010 98012->98011 98013->98010 98014->98010 98019 cec40 438 API calls 98018->98019 98037 cd29d 98019->98037 98020 111bc4 98056 13359c 82 API calls __wsopen_s 98020->98056 98022 cd30b ISource 98022->97936 98023 cd3c3 98025 cd3ce 98023->98025 98026 cd6d5 98023->98026 98024 cd5ff 98028 111bb5 98024->98028 98029 cd614 98024->98029 98027 dfddb 22 API calls 98025->98027 98026->98022 98033 dfe0b 22 API calls 98026->98033 98034 cd3d5 __fread_nolock 98027->98034 98055 145705 23 API calls 98028->98055 98032 dfddb 22 API calls 98029->98032 98030 cd4b8 98036 dfe0b 22 API calls 98030->98036 98043 cd46a 98032->98043 98033->98034 98035 cd3f6 98034->98035 98038 dfddb 22 API calls 98034->98038 98045 cd429 ISource __fread_nolock 98035->98045 98051 cbec0 438 API calls 98035->98051 98036->98045 98037->98020 98037->98022 98037->98023 98037->98026 98037->98030 98039 dfddb 22 API calls 98037->98039 98037->98045 98038->98035 98039->98037 98041 111ba4 98054 13359c 82 API calls __wsopen_s 98041->98054 98043->97936 98044 c1f6f 438 API calls 98044->98045 98045->98024 98045->98041 98045->98043 98045->98044 98046 111b7f 98045->98046 98048 111b5d 98045->98048 98053 13359c 82 API calls __wsopen_s 98046->98053 98052 13359c 82 API calls __wsopen_s 98048->98052 98050->97938 98051->98045 98052->98043 98053->98043 98054->98043 98055->98020 98056->98022 98120 152ad8 98057->98120 98059 15159f 98059->97985 98061 c7510 53 API calls 98060->98061 98062 135c6d 98061->98062 98158 12dbbe lstrlenW 98062->98158 98064 135c77 98064->97985 98163 14f57d 98065->98163 98067 1507ec 98068 1507f0 98067->98068 98069 150842 98067->98069 98211 cb567 98067->98211 98068->97985 98070 c7510 53 API calls 98069->98070 98072 150857 98070->98072 98189 12a1c5 98072->98189 98073 150818 98073->98069 98075 15081c 98073->98075 98076 c7510 53 API calls 98075->98076 98077 150831 98076->98077 98216 12a396 87 API calls 98077->98216 98574 14aff9 98079->98574 98083 c7510 53 API calls 98082->98083 98084 14a306 98083->98084 98085 12d4dc 47 API calls 98084->98085 98086 14a315 98085->98086 98086->97985 98088 14aff9 217 API calls 98087->98088 98090 14ac0c 98088->98090 98089 14ac54 98089->97985 98090->98089 98091 caceb 23 API calls 98090->98091 98091->98089 98093 152ad8 54 API calls 98092->98093 98094 1519cb 98093->98094 98094->97985 98096 cb567 39 API calls 98095->98096 98097 df659 98096->98097 98098 df661 timeGetTime 98097->98098 98099 11f2dc Sleep 98097->98099 98100 cb567 39 API calls 98098->98100 98101 df677 98100->98101 98101->97985 98102->97978 98103->97946 98105 c9cc2 _wcslen 98104->98105 98106 dfe0b 22 API calls 98105->98106 98107 c9cea __fread_nolock 98106->98107 98108 dfddb 22 API calls 98107->98108 98109 c9d00 98108->98109 98109->97958 98110->97949 98111->97971 98112->97971 98113->97948 98114->97985 98115->97985 98116->97985 98117->97982 98118->97985 98119->97985 98121 caceb 23 API calls 98120->98121 98122 152af3 98121->98122 98123 152b1d 98122->98123 98124 152aff 98122->98124 98125 c6b57 22 API calls 98123->98125 98130 c7510 98124->98130 98127 152b1b 98125->98127 98127->98059 98131 c7525 98130->98131 98147 c7522 98130->98147 98132 c752d 98131->98132 98133 c755b 98131->98133 98154 e51c6 26 API calls 98132->98154 98135 1050f6 98133->98135 98138 c756d 98133->98138 98139 10500f 98133->98139 98157 e5183 26 API calls 98135->98157 98136 c753d 98143 dfddb 22 API calls 98136->98143 98155 dfb21 51 API calls 98138->98155 98146 dfe0b 22 API calls 98139->98146 98152 105088 98139->98152 98141 10510e 98141->98141 98144 c7547 98143->98144 98145 c9cb3 22 API calls 98144->98145 98145->98147 98149 105058 98146->98149 98147->98127 98153 ca8c7 22 API calls __fread_nolock 98147->98153 98148 dfddb 22 API calls 98150 10507f 98148->98150 98149->98148 98151 c9cb3 22 API calls 98150->98151 98151->98152 98156 dfb21 51 API calls 98152->98156 98153->98127 98154->98136 98155->98136 98156->98135 98157->98141 98159 12dc06 98158->98159 98160 12dbdc GetFileAttributesW 98158->98160 98159->98064 98160->98159 98161 12dbe8 FindFirstFileW 98160->98161 98161->98159 98162 12dbf9 FindClose 98161->98162 98162->98159 98164 caceb 23 API calls 98163->98164 98165 14f59e 98164->98165 98166 c7510 53 API calls 98165->98166 98167 14f5ab 98166->98167 98169 14f5be 98167->98169 98238 ca8c7 22 API calls __fread_nolock 98167->98238 98170 14f5fe 98169->98170 98172 14f618 98169->98172 98188 14f5cd 98169->98188 98239 1239c0 22 API calls 98170->98239 98173 14f674 98172->98173 98174 14f643 98172->98174 98172->98188 98177 14f695 98173->98177 98178 14f681 98173->98178 98175 ca961 22 API calls 98174->98175 98176 14f64c 98175->98176 98217 122f52 98176->98217 98181 c7510 53 API calls 98177->98181 98180 cb567 39 API calls 98178->98180 98183 14f686 98180->98183 98184 14f69a 98181->98184 98241 123608 23 API calls 98183->98241 98242 1230f7 44 API calls _wcslen 98184->98242 98188->98067 98251 12b12f 98189->98251 98192 12a1f6 98388 12a9ed 23 API calls 98192->98388 98193 12a21a 98264 c6270 98193->98264 98196 12a200 98389 129c79 11 API calls 98196->98389 98198 12a210 98198->98193 98199 12a2e7 98201 12a306 98199->98201 98391 12acda 98199->98391 98200 12a227 98200->98199 98269 129f3f 98200->98269 98277 de2a2 98200->98277 98282 12a442 98200->98282 98390 12a324 57 API calls 98200->98390 98204 12b12f 10 API calls 98201->98204 98206 12a312 98204->98206 98206->98068 98212 cb578 98211->98212 98213 cb57f 98211->98213 98212->98213 98573 e62d1 39 API calls _strftime 98212->98573 98213->98073 98215 cb5c2 98215->98073 98216->98068 98218 c6b57 22 API calls 98217->98218 98219 122f6c 98218->98219 98243 122da7 98219->98243 98222 12302a 98224 122da7 4 API calls 98222->98224 98223 122f8c 98248 122dee GetParent 98223->98248 98237 123025 98224->98237 98226 122f95 98226->98222 98227 122f9d 98226->98227 98249 1239c0 22 API calls 98227->98249 98229 122fab GetClassNameW 98230 c6b57 22 API calls 98229->98230 98231 122fdd EnumChildWindows 98230->98231 98250 dfb21 51 API calls 98231->98250 98233 12300a 98234 c6b57 22 API calls 98233->98234 98235 12301c 98234->98235 98236 122da7 4 API calls 98235->98236 98236->98237 98237->98188 98240 1239c0 22 API calls 98237->98240 98238->98169 98239->98188 98240->98188 98241->98188 98242->98188 98244 122dcf GetWindowThreadProcessId GetCurrentThreadId AttachThreadInput 98243->98244 98245 122db6 SendMessageTimeoutW 98243->98245 98246 122dea GetFocus 98244->98246 98245->98244 98245->98246 98246->98222 98246->98223 98248->98226 98249->98229 98250->98233 98252 12b148 GetCurrentThreadId 98251->98252 98253 12b13e 98251->98253 98254 12b163 GetForegroundWindow GetWindowThreadProcessId AttachThreadInput 98252->98254 98255 12b1ea 98252->98255 98253->98252 98263 12a1e1 98253->98263 98258 12b188 GetWindowThreadProcessId 98254->98258 98254->98263 98256 12b214 98255->98256 98257 12b1f4 AttachThreadInput 98255->98257 98259 12b219 AttachThreadInput 98256->98259 98257->98259 98260 12b20e AttachThreadInput 98257->98260 98261 12b1a2 AttachThreadInput 98258->98261 98262 12b1b4 AttachThreadInput 98258->98262 98259->98263 98260->98256 98261->98262 98262->98263 98263->98192 98263->98193 98265 dfe0b 22 API calls 98264->98265 98266 c6295 98265->98266 98267 dfddb 22 API calls 98266->98267 98268 c62a3 98267->98268 98268->98200 98270 129f48 98269->98270 98271 129f78 98269->98271 98270->98271 98272 129f50 IsWindow 98270->98272 98271->98200 98272->98271 98273 129f5d GetForegroundWindow 98272->98273 98273->98271 98274 129f68 98273->98274 98274->98273 98276 129f76 98274->98276 98424 12b0a8 14 API calls 98274->98424 98276->98271 98278 ca6c3 22 API calls 98277->98278 98280 de2b7 98278->98280 98279 de2f2 98279->98200 98280->98279 98425 c49bd 22 API calls __fread_nolock 98280->98425 98283 12a468 98282->98283 98284 ca961 22 API calls 98283->98284 98285 12a476 98284->98285 98286 ca961 22 API calls 98285->98286 98287 12a47e 98286->98287 98288 de2a2 22 API calls 98287->98288 98292 12a493 98288->98292 98290 12a4ef 98291 12a5fb 98290->98291 98426 e4a28 98290->98426 98293 12a640 98291->98293 98294 12a606 98291->98294 98292->98290 98316 de2a2 22 API calls 98292->98316 98295 12a652 98293->98295 98296 12a69e 98293->98296 98297 c4c6d 22 API calls 98294->98297 98436 12b2df 98295->98436 98300 12a6f2 98296->98300 98301 12a752 98296->98301 98302 12a833 98296->98302 98303 12a850 98296->98303 98304 12a6b1 98296->98304 98305 12a816 98296->98305 98306 12a714 98296->98306 98307 12a7f9 98296->98307 98308 12a73c 98296->98308 98309 12a7e3 98296->98309 98310 12a7c6 98296->98310 98311 12a8a4 98296->98311 98312 12a88a 98296->98312 98313 12a78a 98296->98313 98314 12a86d 98296->98314 98343 12a68d 98296->98343 98299 12a610 98297->98299 98459 12b27a VkKeyScanW MapVirtualKeyW 98299->98459 98324 12b2df MapVirtualKeyW 98300->98324 98320 12b2df MapVirtualKeyW 98301->98320 98338 12b2df MapVirtualKeyW 98302->98338 98302->98343 98339 12b2df MapVirtualKeyW 98303->98339 98303->98343 98321 12b2df MapVirtualKeyW 98304->98321 98336 12b2df MapVirtualKeyW 98305->98336 98305->98343 98330 12b2df MapVirtualKeyW 98306->98330 98306->98343 98334 12b2df MapVirtualKeyW 98307->98334 98307->98343 98337 12b2df MapVirtualKeyW 98308->98337 98308->98343 98329 12b2df MapVirtualKeyW 98309->98329 98309->98343 98328 12b2df MapVirtualKeyW 98310->98328 98310->98343 98325 12a8b7 98311->98325 98326 12a636 98311->98326 98341 12b2df MapVirtualKeyW 98312->98341 98312->98343 98322 12b2df MapVirtualKeyW 98313->98322 98340 12b2df MapVirtualKeyW 98314->98340 98314->98343 98319 12a4d8 98316->98319 98318 12a663 98331 12a6cf 98318->98331 98332 12a66b 98318->98332 98335 e4a28 _strftime 40 API calls 98319->98335 98327 12a6bb 98320->98327 98321->98327 98322->98327 98323 12a61c 98342 12a624 98323->98342 98348 12a6bf 98323->98348 98324->98327 98345 12b2df MapVirtualKeyW 98325->98345 98363 12a8d1 98325->98363 98478 12a324 57 API calls 98326->98478 98327->98348 98351 12a6cb 98327->98351 98328->98348 98329->98331 98330->98348 98331->98343 98352 12ab9c 20 API calls 98331->98352 98346 12a67b 98332->98346 98354 12a692 98332->98354 98333 12aa57 20 API calls 98333->98343 98334->98348 98347 12a4e5 98335->98347 98336->98331 98337->98331 98338->98348 98339->98331 98340->98348 98341->98331 98342->98331 98349 12a62c 98342->98349 98343->98200 98350 12a8c6 98345->98350 98460 12a9ed 23 API calls 98346->98460 98347->98290 98357 e4a28 _strftime 40 API calls 98347->98357 98348->98333 98348->98343 98353 c4c6d 22 API calls 98349->98353 98355 12aa57 20 API calls 98350->98355 98351->98331 98461 12aa57 98351->98461 98352->98343 98353->98326 98440 12a982 98354->98440 98355->98363 98360 12a503 98357->98360 98359 12a913 98359->98343 98364 12b2df MapVirtualKeyW 98359->98364 98360->98290 98365 e4a28 _strftime 40 API calls 98360->98365 98362 c4c6d 22 API calls 98362->98363 98363->98359 98363->98362 98366 12b2df MapVirtualKeyW 98363->98366 98368 12aa57 20 API calls 98363->98368 98479 12ab9c 98363->98479 98364->98331 98367 12a51d 98365->98367 98366->98363 98367->98290 98369 e4a28 _strftime 40 API calls 98367->98369 98368->98363 98370 12a539 98369->98370 98370->98290 98454 c4c6d 98370->98454 98374 12a5cc 98458 e62d1 39 API calls _strftime 98374->98458 98376 c4c6d 22 API calls 98377 12a565 98376->98377 98378 12a57b 98377->98378 98380 c4c6d 22 API calls 98377->98380 98379 c93b2 22 API calls 98378->98379 98381 12a586 98379->98381 98382 12a575 98380->98382 98383 c4c6d 22 API calls 98381->98383 98382->98374 98382->98378 98384 12a59a 98383->98384 98457 12b30d 51 API calls 98384->98457 98386 12a5bb 98387 c6b57 22 API calls 98386->98387 98387->98290 98388->98196 98389->98198 98390->98200 98392 12acef 98391->98392 98393 12ad16 GetParent 98392->98393 98394 12ae3c 98392->98394 98421 12a2f9 98392->98421 98393->98394 98397 12ad27 GetKeyboardState 98393->98397 98395 12ae42 98394->98395 98396 12ae55 98394->98396 98568 12b226 SendInput keybd_event 98395->98568 98399 12ae5a 98396->98399 98400 12ae6d 98396->98400 98401 12ad95 98397->98401 98413 12ad38 SetKeyboardState 98397->98413 98569 12b226 SendInput keybd_event 98399->98569 98404 12ae82 98400->98404 98405 12ae72 98400->98405 98402 12ada6 PostMessageW 98401->98402 98408 12adbd 98401->98408 98402->98408 98406 12ae97 98404->98406 98407 12ae87 98404->98407 98570 12b226 SendInput keybd_event 98405->98570 98411 12aeac 98406->98411 98412 12ae9c 98406->98412 98571 12b226 SendInput keybd_event 98407->98571 98414 12adc3 PostMessageW 98408->98414 98417 12adda 98408->98417 98416 129c60 14 API calls 98411->98416 98572 12b226 SendInput keybd_event 98412->98572 98413->98401 98414->98417 98416->98421 98418 12ae19 98417->98418 98422 12ae14 PostMessageW 98417->98422 98418->98411 98419 12ae23 PostMessageW 98418->98419 98419->98411 98423 12a9ed 23 API calls 98421->98423 98422->98418 98423->98201 98424->98274 98425->98280 98427 e4aab 98426->98427 98428 e4a36 98426->98428 98497 e4abd 40 API calls 3 library calls 98427->98497 98432 e4a5b 98428->98432 98495 ef2d9 20 API calls _free 98428->98495 98431 e4ab8 98431->98290 98432->98290 98433 e4a42 98496 f27ec 26 API calls __fread_nolock 98433->98496 98435 e4a4d 98435->98290 98437 12b2ea 98436->98437 98438 12b2f7 MapVirtualKeyW 98437->98438 98439 12a65b 98437->98439 98438->98439 98439->98318 98439->98348 98441 12a993 98440->98441 98442 12a9e7 98440->98442 98443 12b2df MapVirtualKeyW 98441->98443 98442->98343 98444 12a9a4 98443->98444 98498 129f91 98444->98498 98447 12acda 23 API calls 98448 12a9c3 98447->98448 98449 12aa57 20 API calls 98448->98449 98450 12ab9c 20 API calls 98448->98450 98451 12a9de 98448->98451 98449->98448 98450->98448 98536 12aeba 23 API calls 98451->98536 98453 12a9e6 98453->98442 98455 caec9 22 API calls 98454->98455 98456 c4c78 98455->98456 98456->98374 98456->98376 98457->98386 98458->98290 98459->98323 98460->98343 98462 12aa81 98461->98462 98463 12ab3e 98461->98463 98462->98463 98468 12aa9c 98462->98468 98464 12ab43 98463->98464 98465 12ab64 SendInput 98463->98465 98469 12ab51 98464->98469 98466 12ab8e 98465->98466 98537 129c60 98466->98537 98471 12aaa5 GetKeyboardState 98468->98471 98472 12ab2b 98468->98472 98546 12b226 SendInput keybd_event 98469->98546 98473 12aab6 SetKeyboardState 98471->98473 98477 12aace 98471->98477 98474 12ab33 PostMessageW 98472->98474 98473->98477 98474->98466 98476 12ab62 98476->98466 98477->98474 98478->98343 98480 12abc6 98479->98480 98481 12ac7c 98479->98481 98480->98481 98486 12abe1 98480->98486 98482 12aca2 SendInput 98481->98482 98483 12ac81 98481->98483 98484 12accc 98482->98484 98489 12ac8f 98483->98489 98558 129c49 98484->98558 98486->98484 98488 12abea GetKeyboardState 98486->98488 98490 12abfb SetKeyboardState 98488->98490 98493 12ac13 98488->98493 98567 12b226 SendInput keybd_event 98489->98567 98490->98493 98492 12aca0 98492->98484 98494 12ac71 PostMessageW 98493->98494 98494->98484 98495->98433 98496->98435 98497->98431 98499 129fa5 98498->98499 98500 12a00b GetKeyboardState 98499->98500 98501 12a088 98499->98501 98502 12a1c0 98500->98502 98503 12a020 SetKeyboardState 98500->98503 98504 12a092 GetAsyncKeyState 98501->98504 98502->98447 98503->98502 98506 12a0c0 98504->98506 98507 12a0af GetKeyState 98504->98507 98508 12a0de GetAsyncKeyState 98506->98508 98509 12b2df MapVirtualKeyW 98506->98509 98507->98506 98507->98508 98510 12a100 98508->98510 98511 12a0ef GetKeyState 98508->98511 98512 12a0d3 98509->98512 98513 12a11e GetAsyncKeyState 98510->98513 98517 12b2df MapVirtualKeyW 98510->98517 98511->98510 98511->98513 98516 12ab9c 20 API calls 98512->98516 98514 12a13a 98513->98514 98515 12a12c GetKeyState 98513->98515 98518 12a155 GetAsyncKeyState 98514->98518 98521 12b2df MapVirtualKeyW 98514->98521 98515->98514 98515->98518 98516->98508 98519 12a113 98517->98519 98522 12a163 GetKeyState 98518->98522 98523 12a171 98518->98523 98520 12ab9c 20 API calls 98519->98520 98520->98513 98524 12a14a 98521->98524 98522->98523 98525 12a18c GetAsyncKeyState 98522->98525 98523->98525 98529 12b2df MapVirtualKeyW 98523->98529 98528 12ab9c 20 API calls 98524->98528 98526 12a1a3 98525->98526 98527 12a19a GetKeyState 98525->98527 98530 12a1be 98526->98530 98532 12b2df MapVirtualKeyW 98526->98532 98527->98526 98527->98530 98528->98518 98531 12a181 98529->98531 98530->98502 98533 12ab9c 20 API calls 98531->98533 98534 12a1b3 98532->98534 98533->98525 98535 12ab9c 20 API calls 98534->98535 98535->98530 98536->98453 98538 129c6f 98537->98538 98539 12ab95 98538->98539 98540 12b0b7 Sleep 98538->98540 98542 12b0c0 QueryPerformanceCounter 98538->98542 98539->98331 98540->98539 98542->98540 98545 12b0ce 98542->98545 98543 12b0e7 Sleep QueryPerformanceCounter 98547 de398 98543->98547 98545->98539 98545->98543 98546->98476 98548 de3b4 98547->98548 98554 de3ad 98547->98554 98555 e0242 5 API calls __Init_thread_wait 98548->98555 98550 de3c0 98550->98554 98556 de3de QueryPerformanceFrequency 98550->98556 98552 de3d4 98557 e01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 98552->98557 98554->98545 98555->98550 98556->98552 98557->98554 98560 129c57 98558->98560 98559 12b0b7 Sleep 98566 12acd3 98559->98566 98560->98559 98562 12b0c0 QueryPerformanceCounter 98560->98562 98560->98566 98562->98559 98565 12b0ce 98562->98565 98563 12b0e7 Sleep QueryPerformanceCounter 98564 de398 10 API calls 98563->98564 98564->98565 98565->98563 98565->98566 98566->98363 98567->98492 98568->98396 98569->98400 98570->98404 98571->98406 98572->98411 98573->98215 98575 14b01d ___scrt_fastfail 98574->98575 98576 14b094 98575->98576 98577 14b058 98575->98577 98580 cb567 39 API calls 98576->98580 98584 14b08b 98576->98584 98578 cb567 39 API calls 98577->98578 98581 14b063 98578->98581 98579 14b0ed 98582 c7510 53 API calls 98579->98582 98583 14b0a5 98580->98583 98581->98584 98588 cb567 39 API calls 98581->98588 98586 14b10b 98582->98586 98587 cb567 39 API calls 98583->98587 98584->98579 98585 cb567 39 API calls 98584->98585 98585->98579 98665 c7620 98586->98665 98587->98584 98589 14b078 98588->98589 98591 cb567 39 API calls 98589->98591 98591->98584 98592 14b115 98593 14b11f 98592->98593 98594 14b1d8 98592->98594 98596 c7510 53 API calls 98593->98596 98595 14b20a GetCurrentDirectoryW 98594->98595 98597 c7510 53 API calls 98594->98597 98598 dfe0b 22 API calls 98595->98598 98599 14b130 98596->98599 98600 14b1ef 98597->98600 98601 14b22f GetCurrentDirectoryW 98598->98601 98602 c7620 22 API calls 98599->98602 98603 c7620 22 API calls 98600->98603 98604 14b23c 98601->98604 98605 14b13a 98602->98605 98606 14b1f9 _wcslen 98603->98606 98608 14b275 98604->98608 98672 c9c6e 22 API calls 98604->98672 98607 c7510 53 API calls 98605->98607 98606->98595 98606->98608 98609 14b14b 98607->98609 98616 14b287 98608->98616 98617 14b28b 98608->98617 98611 c7620 22 API calls 98609->98611 98613 14b155 98611->98613 98612 14b255 98673 c9c6e 22 API calls 98612->98673 98615 c7510 53 API calls 98613->98615 98619 14b166 98615->98619 98621 14b2f8 98616->98621 98622 14b39a CreateProcessW 98616->98622 98675 1307c0 10 API calls 98617->98675 98618 14b265 98674 c9c6e 22 API calls 98618->98674 98624 c7620 22 API calls 98619->98624 98678 1211c8 39 API calls 98621->98678 98664 14b32f _wcslen 98622->98664 98627 14b170 98624->98627 98625 14b294 98676 1306e6 10 API calls 98625->98676 98630 14b1a6 GetSystemDirectoryW 98627->98630 98634 c7510 53 API calls 98627->98634 98629 14b2fd 98632 14b323 98629->98632 98633 14b32a 98629->98633 98636 dfe0b 22 API calls 98630->98636 98631 14b2aa 98677 1305a7 8 API calls 98631->98677 98679 121201 128 API calls 2 library calls 98632->98679 98680 1214ce 6 API calls 98633->98680 98639 14b187 98634->98639 98637 14b1cb GetSystemDirectoryW 98636->98637 98637->98604 98643 c7620 22 API calls 98639->98643 98641 14b2d0 98641->98616 98642 14b328 98642->98664 98646 14b191 _wcslen 98643->98646 98644 14b3d6 GetLastError 98656 14b41a 98644->98656 98645 14b42f CloseHandle 98647 14b43f 98645->98647 98657 14b49a 98645->98657 98646->98604 98646->98630 98649 14b446 CloseHandle 98647->98649 98650 14b451 98647->98650 98649->98650 98651 14b463 98650->98651 98652 14b458 CloseHandle 98650->98652 98654 14b475 98651->98654 98655 14b46a CloseHandle 98651->98655 98652->98651 98653 14b4a6 98653->98656 98681 1309d9 34 API calls 98654->98681 98655->98654 98669 130175 98656->98669 98657->98653 98662 14b4d2 CloseHandle 98657->98662 98661 14b486 98682 14b536 25 API calls 98661->98682 98662->98656 98664->98644 98664->98645 98666 c762a _wcslen 98665->98666 98667 dfe0b 22 API calls 98666->98667 98668 c763f 98667->98668 98668->98592 98683 13030f 98669->98683 98672->98612 98673->98618 98674->98608 98675->98625 98676->98631 98677->98641 98678->98629 98679->98642 98680->98664 98681->98661 98682->98657 98684 130321 CloseHandle 98683->98684 98685 130329 98683->98685 98684->98685 98686 130336 98685->98686 98687 13032e CloseHandle 98685->98687 98688 130343 98686->98688 98689 13033b CloseHandle 98686->98689 98687->98686 98690 130350 98688->98690 98691 130348 CloseHandle 98688->98691 98689->98688 98692 130355 CloseHandle 98690->98692 98693 13035d 98690->98693 98691->98690 98692->98693 98694 130362 CloseHandle 98693->98694 98695 13017d 98693->98695 98694->98695 98695->97985 98700 12df02 98696->98700 98697 12df19 98706 e62fb 39 API calls _strftime 98697->98706 98700->98697 98701 12df1f 98700->98701 98705 e63b2 GetStringTypeW _strftime 98700->98705 98701->98010 98702->98010 98703->98010 98704->98010 98705->98700 98706->98701 98707 cf7bf 98708 cfcb6 98707->98708 98709 cf7d3 98707->98709 98710 caceb 23 API calls 98708->98710 98711 cfcc2 98709->98711 98712 dfddb 22 API calls 98709->98712 98710->98711 98713 caceb 23 API calls 98711->98713 98714 cf7e5 98712->98714 98716 cfd3d 98713->98716 98714->98711 98715 cf83e 98714->98715 98714->98716 98718 d1310 438 API calls 98715->98718 98739 ced9d ISource 98715->98739 98744 131155 22 API calls 98716->98744 98738 cec76 ISource 98718->98738 98720 cfef7 98720->98739 98746 ca8c7 22 API calls __fread_nolock 98720->98746 98722 114600 98722->98739 98745 ca8c7 22 API calls __fread_nolock 98722->98745 98723 114b0b 98748 13359c 82 API calls __wsopen_s 98723->98748 98729 ca8c7 22 API calls 98729->98738 98730 cfbe3 98732 114bdc 98730->98732 98730->98739 98741 cf3ae ISource 98730->98741 98731 ca961 22 API calls 98731->98738 98749 13359c 82 API calls __wsopen_s 98732->98749 98734 e0242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 98734->98738 98735 114beb 98750 13359c 82 API calls __wsopen_s 98735->98750 98736 dfddb 22 API calls 98736->98738 98737 e00a3 29 API calls pre_c_initialization 98737->98738 98738->98720 98738->98722 98738->98723 98738->98729 98738->98730 98738->98731 98738->98734 98738->98735 98738->98736 98738->98737 98738->98739 98740 e01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 98738->98740 98738->98741 98742 d01e0 438 API calls 2 library calls 98738->98742 98743 d06a0 41 API calls ISource 98738->98743 98740->98738 98741->98739 98747 13359c 82 API calls __wsopen_s 98741->98747 98742->98738 98743->98738 98744->98739 98745->98739 98746->98739 98747->98739 98748->98739 98749->98735 98750->98739 98751 c1098 98756 c42de 98751->98756 98755 c10a7 98757 ca961 22 API calls 98756->98757 98758 c42f5 GetVersionExW 98757->98758 98759 c6b57 22 API calls 98758->98759 98760 c4342 98759->98760 98761 c93b2 22 API calls 98760->98761 98765 c4378 98760->98765 98762 c436c 98761->98762 98764 c37a0 22 API calls 98762->98764 98763 c441b GetCurrentProcess IsWow64Process 98766 c4437 98763->98766 98764->98765 98765->98763 98773 1037df 98765->98773 98767 c444f LoadLibraryA 98766->98767 98768 103824 GetSystemInfo 98766->98768 98769 c449c GetSystemInfo 98767->98769 98770 c4460 GetProcAddress 98767->98770 98772 c4476 98769->98772 98770->98769 98771 c4470 GetNativeSystemInfo 98770->98771 98771->98772 98774 c447a FreeLibrary 98772->98774 98775 c109d 98772->98775 98774->98775 98776 e00a3 29 API calls __onexit 98775->98776 98776->98755 98777 102ba5 98778 c2b25 98777->98778 98779 102baf 98777->98779 98805 c2b83 7 API calls 98778->98805 98820 c3a5a 98779->98820 98783 102bb8 98784 c9cb3 22 API calls 98783->98784 98786 102bc6 98784->98786 98788 102bf5 98786->98788 98789 102bce 98786->98789 98787 c2b2f 98792 c2b44 98787->98792 98809 c3837 98787->98809 98793 c33c6 22 API calls 98788->98793 98827 c33c6 98789->98827 98797 c2b5f 98792->98797 98819 c30f2 Shell_NotifyIconW ___scrt_fastfail 98792->98819 98795 102bf1 GetForegroundWindow ShellExecuteW 98793->98795 98801 102c26 98795->98801 98803 c2b66 SetCurrentDirectoryW 98797->98803 98799 102be7 98802 c33c6 22 API calls 98799->98802 98801->98797 98802->98795 98804 c2b7a 98803->98804 98837 c2cd4 7 API calls 98805->98837 98807 c2b2a 98808 c2c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 98807->98808 98808->98787 98810 c3862 ___scrt_fastfail 98809->98810 98838 c4212 98810->98838 98814 103386 Shell_NotifyIconW 98815 c3906 Shell_NotifyIconW 98842 c3923 98815->98842 98816 c38e8 98816->98814 98816->98815 98818 c391c 98818->98792 98819->98797 98821 101f50 __wsopen_s 98820->98821 98822 c3a67 GetModuleFileNameW 98821->98822 98823 c9cb3 22 API calls 98822->98823 98824 c3a8d 98823->98824 98825 c3aa2 23 API calls 98824->98825 98826 c3a97 98825->98826 98826->98783 98828 c33dd 98827->98828 98829 1030bb 98827->98829 98868 c33ee 98828->98868 98831 dfddb 22 API calls 98829->98831 98833 1030c5 _wcslen 98831->98833 98832 c33e8 98836 c6350 22 API calls 98832->98836 98834 dfe0b 22 API calls 98833->98834 98835 1030fe __fread_nolock 98834->98835 98836->98799 98837->98807 98839 1035a4 98838->98839 98840 c38b7 98838->98840 98839->98840 98841 1035ad DestroyIcon 98839->98841 98840->98816 98864 12c874 42 API calls _strftime 98840->98864 98841->98840 98843 c393f 98842->98843 98862 c3a13 98842->98862 98844 c6270 22 API calls 98843->98844 98845 c394d 98844->98845 98846 103393 LoadStringW 98845->98846 98847 c395a 98845->98847 98849 1033ad 98846->98849 98848 c6b57 22 API calls 98847->98848 98850 c396f 98848->98850 98858 c3994 ___scrt_fastfail 98849->98858 98866 ca8c7 22 API calls __fread_nolock 98849->98866 98851 c397c 98850->98851 98852 1033c9 98850->98852 98851->98849 98854 c3986 98851->98854 98867 c6350 22 API calls 98852->98867 98865 c6350 22 API calls 98854->98865 98857 1033d7 98857->98858 98859 c33c6 22 API calls 98857->98859 98860 c39f9 Shell_NotifyIconW 98858->98860 98861 1033f9 98859->98861 98860->98862 98863 c33c6 22 API calls 98861->98863 98862->98818 98863->98858 98864->98816 98865->98858 98866->98858 98867->98857 98869 c33fe _wcslen 98868->98869 98870 10311d 98869->98870 98871 c3411 98869->98871 98872 dfddb 22 API calls 98870->98872 98878 ca587 98871->98878 98875 103127 98872->98875 98874 c341e __fread_nolock 98874->98832 98876 dfe0b 22 API calls 98875->98876 98877 103157 __fread_nolock 98876->98877 98880 ca59d 98878->98880 98882 ca598 __fread_nolock 98878->98882 98879 10f80f 98880->98879 98881 dfe0b 22 API calls 98880->98881 98881->98882 98882->98874 98883 e03fb 98884 e0407 CallCatchBlock 98883->98884 98912 dfeb1 98884->98912 98886 e040e 98887 e0561 98886->98887 98890 e0438 98886->98890 98939 e083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 98887->98939 98889 e0568 98940 e4e52 28 API calls _abort 98889->98940 98901 e0477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 98890->98901 98923 f247d 98890->98923 98892 e056e 98941 e4e04 28 API calls _abort 98892->98941 98896 e0576 98897 e0457 98899 e04d8 98931 e0959 98899->98931 98901->98899 98935 e4e1a 38 API calls 2 library calls 98901->98935 98903 e04de 98904 e04f3 98903->98904 98936 e0992 GetModuleHandleW 98904->98936 98906 e04fa 98906->98889 98907 e04fe 98906->98907 98908 e0507 98907->98908 98937 e4df5 28 API calls _abort 98907->98937 98938 e0040 13 API calls 2 library calls 98908->98938 98911 e050f 98911->98897 98913 dfeba 98912->98913 98942 e0698 IsProcessorFeaturePresent 98913->98942 98915 dfec6 98943 e2c94 10 API calls 3 library calls 98915->98943 98917 dfecb 98922 dfecf 98917->98922 98944 f2317 98917->98944 98920 dfee6 98920->98886 98922->98886 98924 f2494 98923->98924 98925 e0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 98924->98925 98926 e0451 98925->98926 98926->98897 98927 f2421 98926->98927 98928 f2450 98927->98928 98929 e0a8c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 98928->98929 98930 f2479 98929->98930 98930->98901 98995 e2340 98931->98995 98934 e097f 98934->98903 98935->98899 98936->98906 98937->98908 98938->98911 98939->98889 98940->98892 98941->98896 98942->98915 98943->98917 98948 fd1f6 98944->98948 98947 e2cbd 8 API calls 3 library calls 98947->98922 98949 fd213 98948->98949 98952 fd20f 98948->98952 98949->98952 98954 f4bfb 98949->98954 98951 dfed8 98951->98920 98951->98947 98966 e0a8c 98952->98966 98955 f4c07 CallCatchBlock 98954->98955 98973 f2f5e EnterCriticalSection 98955->98973 98957 f4c0e 98974 f50af 98957->98974 98959 f4c1d 98965 f4c2c 98959->98965 98987 f4a8f 29 API calls 98959->98987 98962 f4c27 98988 f4b45 GetStdHandle GetFileType 98962->98988 98963 f4c3d __fread_nolock 98963->98949 98989 f4c48 LeaveCriticalSection _abort 98965->98989 98967 e0a97 IsProcessorFeaturePresent 98966->98967 98968 e0a95 98966->98968 98970 e0c5d 98967->98970 98968->98951 98994 e0c21 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 98970->98994 98972 e0d40 98972->98951 98973->98957 98975 f50bb CallCatchBlock 98974->98975 98976 f50df 98975->98976 98977 f50c8 98975->98977 98990 f2f5e EnterCriticalSection 98976->98990 98991 ef2d9 20 API calls _free 98977->98991 98980 f50cd 98992 f27ec 26 API calls __fread_nolock 98980->98992 98982 f50d7 __fread_nolock 98982->98959 98983 f5117 98993 f513e LeaveCriticalSection _abort 98983->98993 98985 f50eb 98985->98983 98986 f5000 __wsopen_s 21 API calls 98985->98986 98986->98985 98987->98962 98988->98965 98989->98963 98990->98985 98991->98980 98992->98982 98993->98982 98994->98972 98996 e096c GetStartupInfoW 98995->98996 98996->98934 98997 c105b 99002 c344d 98997->99002 98999 c106a 99033 e00a3 29 API calls __onexit 98999->99033 99001 c1074 99003 c345d __wsopen_s 99002->99003 99004 ca961 22 API calls 99003->99004 99005 c3513 99004->99005 99006 c3a5a 24 API calls 99005->99006 99007 c351c 99006->99007 99034 c3357 99007->99034 99010 c33c6 22 API calls 99011 c3535 99010->99011 99012 c515f 22 API calls 99011->99012 99013 c3544 99012->99013 99014 ca961 22 API calls 99013->99014 99015 c354d 99014->99015 99016 ca6c3 22 API calls 99015->99016 99017 c3556 RegOpenKeyExW 99016->99017 99018 103176 RegQueryValueExW 99017->99018 99022 c3578 99017->99022 99019 103193 99018->99019 99020 10320c RegCloseKey 99018->99020 99021 dfe0b 22 API calls 99019->99021 99020->99022 99026 10321e _wcslen 99020->99026 99023 1031ac 99021->99023 99022->98999 99025 c5722 22 API calls 99023->99025 99024 c4c6d 22 API calls 99024->99026 99027 1031b7 RegQueryValueExW 99025->99027 99026->99022 99026->99024 99031 c9cb3 22 API calls 99026->99031 99032 c515f 22 API calls 99026->99032 99028 1031d4 99027->99028 99030 1031ee ISource 99027->99030 99029 c6b57 22 API calls 99028->99029 99029->99030 99030->99020 99031->99026 99032->99026 99033->99001 99035 101f50 __wsopen_s 99034->99035 99036 c3364 GetFullPathNameW 99035->99036 99037 c3386 99036->99037 99038 c6b57 22 API calls 99037->99038 99039 c33a4 99038->99039 99039->99010 99040 c3156 99043 c3170 99040->99043 99044 c3187 99043->99044 99045 c318c 99044->99045 99046 c31eb 99044->99046 99087 c31e9 99044->99087 99050 c3199 99045->99050 99051 c3265 PostQuitMessage 99045->99051 99048 102dfb 99046->99048 99049 c31f1 99046->99049 99047 c31d0 DefWindowProcW 99084 c316a 99047->99084 99099 c18e2 10 API calls 99048->99099 99052 c321d SetTimer RegisterWindowMessageW 99049->99052 99053 c31f8 99049->99053 99055 c31a4 99050->99055 99056 102e7c 99050->99056 99051->99084 99060 c3246 CreatePopupMenu 99052->99060 99052->99084 99057 102d9c 99053->99057 99058 c3201 KillTimer 99053->99058 99061 c31ae 99055->99061 99062 102e68 99055->99062 99103 12bf30 34 API calls ___scrt_fastfail 99056->99103 99064 102da1 99057->99064 99065 102dd7 MoveWindow 99057->99065 99095 c30f2 Shell_NotifyIconW ___scrt_fastfail 99058->99095 99059 102e1c 99100 de499 42 API calls 99059->99100 99060->99084 99069 c31b9 99061->99069 99070 102e4d 99061->99070 99088 12c161 99062->99088 99072 102dc6 SetFocus 99064->99072 99073 102da7 99064->99073 99065->99084 99075 c3253 99069->99075 99082 c31c4 99069->99082 99070->99047 99102 120ad7 22 API calls 99070->99102 99071 102e8e 99071->99047 99071->99084 99072->99084 99076 102db0 99073->99076 99073->99082 99074 c3214 99096 c3c50 DeleteObject DestroyWindow 99074->99096 99097 c326f 44 API calls ___scrt_fastfail 99075->99097 99098 c18e2 10 API calls 99076->99098 99081 c3263 99081->99084 99082->99047 99101 c30f2 Shell_NotifyIconW ___scrt_fastfail 99082->99101 99085 102e41 99086 c3837 49 API calls 99085->99086 99086->99087 99087->99047 99089 12c276 99088->99089 99090 12c179 ___scrt_fastfail 99088->99090 99089->99084 99091 c3923 24 API calls 99090->99091 99093 12c1a0 99091->99093 99092 12c25f KillTimer SetTimer 99092->99089 99093->99092 99094 12c251 Shell_NotifyIconW 99093->99094 99094->99092 99095->99074 99096->99084 99097->99081 99098->99084 99099->99059 99100->99082 99101->99085 99102->99087 99103->99071 99104 c2e37 99105 ca961 22 API calls 99104->99105 99106 c2e4d 99105->99106 99183 c4ae3 99106->99183 99108 c2e6b 99109 c3a5a 24 API calls 99108->99109 99110 c2e7f 99109->99110 99111 c9cb3 22 API calls 99110->99111 99112 c2e8c 99111->99112 99113 c4ecb 94 API calls 99112->99113 99114 c2ea5 99113->99114 99115 102cb0 99114->99115 99116 c2ead 99114->99116 99117 132cf9 80 API calls 99115->99117 99197 ca8c7 22 API calls __fread_nolock 99116->99197 99118 102cc3 99117->99118 99119 102ccf 99118->99119 99121 c4f39 68 API calls 99118->99121 99124 c4f39 68 API calls 99119->99124 99121->99119 99122 c2ec3 99198 c6f88 22 API calls 99122->99198 99126 102ce5 99124->99126 99125 c2ecf 99127 c9cb3 22 API calls 99125->99127 99211 c3084 22 API calls 99126->99211 99128 c2edc 99127->99128 99199 ca81b 41 API calls 99128->99199 99130 c2eec 99133 c9cb3 22 API calls 99130->99133 99132 102d02 99212 c3084 22 API calls 99132->99212 99135 c2f12 99133->99135 99200 ca81b 41 API calls 99135->99200 99136 102d1e 99138 c3a5a 24 API calls 99136->99138 99139 102d44 99138->99139 99213 c3084 22 API calls 99139->99213 99140 c2f21 99143 ca961 22 API calls 99140->99143 99142 102d50 99214 ca8c7 22 API calls __fread_nolock 99142->99214 99145 c2f3f 99143->99145 99201 c3084 22 API calls 99145->99201 99146 102d5e 99215 c3084 22 API calls 99146->99215 99148 c2f4b 99150 e4a28 _strftime 40 API calls 99148->99150 99152 c2f59 99150->99152 99151 102d6d 99216 ca8c7 22 API calls __fread_nolock 99151->99216 99152->99126 99153 c2f63 99152->99153 99154 e4a28 _strftime 40 API calls 99153->99154 99157 c2f6e 99154->99157 99156 102d83 99217 c3084 22 API calls 99156->99217 99157->99132 99159 c2f78 99157->99159 99161 e4a28 _strftime 40 API calls 99159->99161 99160 102d90 99162 c2f83 99161->99162 99162->99136 99163 c2f8d 99162->99163 99164 e4a28 _strftime 40 API calls 99163->99164 99165 c2f98 99164->99165 99166 c2fdc 99165->99166 99202 c3084 22 API calls 99165->99202 99166->99151 99167 c2fe8 99166->99167 99167->99160 99205 c63eb 22 API calls 99167->99205 99169 c2fbf 99203 ca8c7 22 API calls __fread_nolock 99169->99203 99172 c2ff8 99206 c6a50 22 API calls 99172->99206 99173 c2fcd 99204 c3084 22 API calls 99173->99204 99176 c3006 99207 c70b0 23 API calls 99176->99207 99180 c3021 99181 c3065 99180->99181 99208 c6f88 22 API calls 99180->99208 99209 c70b0 23 API calls 99180->99209 99210 c3084 22 API calls 99180->99210 99184 c4af0 __wsopen_s 99183->99184 99185 c6b57 22 API calls 99184->99185 99186 c4b22 99184->99186 99185->99186 99187 c4c6d 22 API calls 99186->99187 99193 c4b58 99186->99193 99187->99186 99188 c9cb3 22 API calls 99190 c4c52 99188->99190 99189 c9cb3 22 API calls 99189->99193 99192 c515f 22 API calls 99190->99192 99191 c4c6d 22 API calls 99191->99193 99195 c4c5e 99192->99195 99193->99189 99193->99191 99194 c515f 22 API calls 99193->99194 99196 c4c29 99193->99196 99194->99193 99195->99108 99196->99188 99196->99195 99197->99122 99198->99125 99199->99130 99200->99140 99201->99148 99202->99169 99203->99173 99204->99166 99205->99172 99206->99176 99207->99180 99208->99180 99209->99180 99210->99180 99211->99132 99212->99136 99213->99142 99214->99146 99215->99151 99216->99156 99217->99160 99218 c1033 99223 c4c91 99218->99223 99222 c1042 99224 ca961 22 API calls 99223->99224 99225 c4cff 99224->99225 99231 c3af0 99225->99231 99227 c4d9c 99229 c1038 99227->99229 99234 c51f7 22 API calls __fread_nolock 99227->99234 99230 e00a3 29 API calls __onexit 99229->99230 99230->99222 99235 c3b1c 99231->99235 99234->99227 99236 c3b0f 99235->99236 99237 c3b29 99235->99237 99236->99227 99237->99236 99238 c3b30 RegOpenKeyExW 99237->99238 99238->99236 99239 c3b4a RegQueryValueExW 99238->99239 99240 c3b80 RegCloseKey 99239->99240 99241 c3b6b 99239->99241 99240->99236 99241->99240

                                                                                                                                                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                                                                                                                                                          Function 000C42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 389 c42de-c434d call ca961 GetVersionExW call c6b57 394 103617-10362a 389->394 395 c4353 389->395 397 10362b-10362f 394->397 396 c4355-c4357 395->396 398 c435d-c43bc call c93b2 call c37a0 396->398 399 103656 396->399 400 103631 397->400 401 103632-10363e 397->401 417 c43c2-c43c4 398->417 418 1037df-1037e6 398->418 404 10365d-103660 399->404 400->401 401->397 403 103640-103642 401->403 403->396 406 103648-10364f 403->406 407 103666-1036a8 404->407 408 c441b-c4435 GetCurrentProcess IsWow64Process 404->408 406->394 410 103651 406->410 407->408 411 1036ae-1036b1 407->411 413 c4494-c449a 408->413 414 c4437 408->414 410->399 415 1036b3-1036bd 411->415 416 1036db-1036e5 411->416 419 c443d-c4449 413->419 414->419 420 1036ca-1036d6 415->420 421 1036bf-1036c5 415->421 423 1036e7-1036f3 416->423 424 1036f8-103702 416->424 417->404 422 c43ca-c43dd 417->422 425 103806-103809 418->425 426 1037e8 418->426 427 c444f-c445e LoadLibraryA 419->427 428 103824-103828 GetSystemInfo 419->428 420->408 421->408 431 103726-10372f 422->431 432 c43e3-c43e5 422->432 423->408 434 103704-103710 424->434 435 103715-103721 424->435 436 1037f4-1037fc 425->436 437 10380b-10381a 425->437 433 1037ee 426->433 429 c449c-c44a6 GetSystemInfo 427->429 430 c4460-c446e GetProcAddress 427->430 439 c4476-c4478 429->439 430->429 438 c4470-c4474 GetNativeSystemInfo 430->438 442 103731-103737 431->442 443 10373c-103748 431->443 440 c43eb-c43ee 432->440 441 10374d-103762 432->441 433->436 434->408 435->408 436->425 437->433 444 10381c-103822 437->444 438->439 447 c447a-c447b FreeLibrary 439->447 448 c4481-c4493 439->448 449 103791-103794 440->449 450 c43f4-c440f 440->450 445 103764-10376a 441->445 446 10376f-10377b 441->446 442->408 443->408 444->436 445->408 446->408 447->448 449->408 451 10379a-1037c1 449->451 452 103780-10378c 450->452 453 c4415 450->453 454 1037c3-1037c9 451->454 455 1037ce-1037da 451->455 452->408 453->408 454->408 455->408
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetVersionExW.KERNEL32(?), ref: 000C430D
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,0015CB64,00000000,?,?), ref: 000C4422
                                                                                                                                                                                                                                                                                                                                                                          • IsWow64Process.KERNEL32(00000000,?,?), ref: 000C4429
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 000C4454
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 000C4466
                                                                                                                                                                                                                                                                                                                                                                          • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 000C4474
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,?,?), ref: 000C447B
                                                                                                                                                                                                                                                                                                                                                                          • GetSystemInfo.KERNEL32(?,?,?), ref: 000C44A0
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3290436268-3101561225
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4163626d5772927278403cfea605f28f49a57f836d3b1fdd8a9b53bf3e80218d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: db7587102a40a58df5881e0f1bc71648e5fcf250f3e98e4bbb80a9438556a350
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4163626d5772927278403cfea605f28f49a57f836d3b1fdd8a9b53bf3e80218d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3FA18376D0A3C2FFC716CB6A78416AD7FB87B26320B18449ED49197E62D36047C8CB61
                                                                                                                                                                                                                                                                                                                                                                          Function 000C42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 675 c42a2-c42ba CreateStreamOnHGlobal 676 c42bc-c42d3 FindResourceExW 675->676 677 c42da-c42dd 675->677 678 c42d9 676->678 679 1035ba-1035c9 LoadResource 676->679 678->677 679->678 680 1035cf-1035dd SizeofResource 679->680 680->678 681 1035e3-1035ee LockResource 680->681 681->678 682 1035f4-103612 681->682 682->678
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,000C50AA,?,?,00000000,00000000), ref: 000C42B2
                                                                                                                                                                                                                                                                                                                                                                          • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,000C50AA,?,?,00000000,00000000), ref: 000C42C9
                                                                                                                                                                                                                                                                                                                                                                          • LoadResource.KERNEL32(?,00000000,?,?,000C50AA,?,?,00000000,00000000,?,?,?,?,?,?,000C4F20), ref: 001035BE
                                                                                                                                                                                                                                                                                                                                                                          • SizeofResource.KERNEL32(?,00000000,?,?,000C50AA,?,?,00000000,00000000,?,?,?,?,?,?,000C4F20), ref: 001035D3
                                                                                                                                                                                                                                                                                                                                                                          • LockResource.KERNEL32(000C50AA,?,?,000C50AA,?,?,00000000,00000000,?,?,?,?,?,?,000C4F20,?), ref: 001035E6
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                                                                                                                                                                                                                                                                                                                          • String ID: SCRIPT
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3051347437-3967369404
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d76a7e9d54f7317ce1fcaadf43784a9dcaf41a1448cac42d0c233214586b4fe7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 82bd68b8611ed767056485405dd692ce703ab16ce168d5a52986b413788a9dbf
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d76a7e9d54f7317ce1fcaadf43784a9dcaf41a1448cac42d0c233214586b4fe7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6F117C70600700FFD7218F65DC49F2B7BB9EBC5B52F20416DB8169A6A0DB71D840DA60
                                                                                                                                                                                                                                                                                                                                                                          Function 00102BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 000C2B6B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00191418,?,000C2E7F,?,?,?,00000000), ref: 000C3A78
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32(runas,?,?,?,?,?,00182224), ref: 00102C10
                                                                                                                                                                                                                                                                                                                                                                          • ShellExecuteW.SHELL32(00000000,?,?,00182224), ref: 00102C17
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: runas
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 448630720-4000483414
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8eac3a8e6f19476a08abd25e7b4345e9373a635d40efa4c8a9a178f5e3d8e6bd
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 679c2b2f75c00d100f84de83dfcfcf83a512bd1902dfed9549f553438934faa0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8eac3a8e6f19476a08abd25e7b4345e9373a635d40efa4c8a9a178f5e3d8e6bd
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7311E631208342AACB14FF60D896FFEBBA5AF95300F44542DF082174A3CF318A8AC752
                                                                                                                                                                                                                                                                                                                                                                          Function 0012AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 870 12aa57-12aa7b 871 12aa81-12aa84 870->871 872 12ab3e-12ab41 870->872 871->872 873 12aa8a-12aa8d 871->873 874 12ab43-12ab4f call 129e8d 872->874 875 12ab64-12ab88 SendInput 872->875 873->872 878 12aa93-12aa96 873->878 882 12ab51-12ab53 874->882 883 12ab55 874->883 877 12ab8e-12ab99 call 129c60 875->877 878->872 881 12aa9c-12aa9f 878->881 885 12aaa5-12aab4 GetKeyboardState 881->885 886 12ab2b-12ab2e 881->886 889 12ab57-12ab62 call 12b226 882->889 883->889 887 12aab6-12aac8 SetKeyboardState 885->887 888 12aace-12aae5 call 129e8d 885->888 890 12ab33-12ab3c PostMessageW 886->890 887->888 895 12aaf0-12aaf4 888->895 896 12aae7-12aaea 888->896 889->877 890->877 897 12ab01-12ab05 895->897 898 12aaf6-12aafa 895->898 896->895 900 12ab07-12ab0b 897->900 901 12ab1f-12ab29 897->901 898->897 899 12aafc-12aaff 898->899 899->897 899->901 900->901 902 12ab0d-12ab1d 900->902 901->890 902->890
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0012AAAC
                                                                                                                                                                                                                                                                                                                                                                          • SetKeyboardState.USER32(00000080), ref: 0012AAC8
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0012AB36
                                                                                                                                                                                                                                                                                                                                                                          • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0012AB88
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: KeyboardState$InputMessagePostSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 432972143-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a9d5e39300a76ea2446561aa6425851d8e9769717c9bc472192b3c0b3ec7b417
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 54da06744b220e1ca42f67a3b4830adb48a13c7bbdabfeab80d90d2aa51dc230
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9d5e39300a76ea2446561aa6425851d8e9769717c9bc472192b3c0b3ec7b417
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C6314B30A40328AFFF35CB68EC05BFE7BA6AF54310F84421AF581961D0D37599A5C7A2
                                                                                                                                                                                                                                                                                                                                                                          Function 0012D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 0012D501
                                                                                                                                                                                                                                                                                                                                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 0012D50F
                                                                                                                                                                                                                                                                                                                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 0012D52F
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNELBASE(00000000), ref: 0012D5DC
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 420147892-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 167904b49508cd1a0f988b26d9571081539ce83e04d90205edf6ced3b4f4901b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 89d8c9e9ba4e58502fd5f0b023bf39af2253e79737c76553f1c4cda71f1892f0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 167904b49508cd1a0f988b26d9571081539ce83e04d90205edf6ced3b4f4901b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D317E711083019FD300EF54E885EAFBBF8EF99354F54092DF581861A2EB719999CBA2
                                                                                                                                                                                                                                                                                                                                                                          Function 0012DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?,00105222), ref: 0012DBCE
                                                                                                                                                                                                                                                                                                                                                                          • GetFileAttributesW.KERNELBASE(?), ref: 0012DBDD
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNELBASE(?,?), ref: 0012DBEE
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0012DBFA
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FileFind$AttributesCloseFirstlstrlen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2695905019-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: def91458aadf37262f6dc29bf64214f0161d874ae701f306d898c94f327c03a1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c370d8df1162d1e897619221db79ca135d4e1cc66fae14f974dc8b436ed284cc
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: def91458aadf37262f6dc29bf64214f0161d874ae701f306d898c94f327c03a1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B1F0A030810B209B82246F78FC0D8AA376D9F02336B10470AF836D24E0EBB059B4C6D6
                                                                                                                                                                                                                                                                                                                                                                          Function 0014AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 0 14aff9-14b056 call e2340 3 14b094-14b098 0->3 4 14b058-14b06b call cb567 0->4 5 14b0dd-14b0e0 3->5 6 14b09a-14b0bb call cb567 * 2 3->6 15 14b06d-14b092 call cb567 * 2 4->15 16 14b0c8 4->16 8 14b0f5-14b119 call c7510 call c7620 5->8 9 14b0e2-14b0e5 5->9 30 14b0bf-14b0c4 6->30 32 14b11f-14b178 call c7510 call c7620 call c7510 call c7620 call c7510 call c7620 8->32 33 14b1d8-14b1e0 8->33 12 14b0e8-14b0ed call cb567 9->12 12->8 15->30 20 14b0cb-14b0cf 16->20 26 14b0d1-14b0d7 20->26 27 14b0d9-14b0db 20->27 26->12 27->5 27->8 30->5 34 14b0c6 30->34 80 14b1a6-14b1d6 GetSystemDirectoryW call dfe0b GetSystemDirectoryW 32->80 81 14b17a-14b195 call c7510 call c7620 32->81 35 14b1e2-14b1fd call c7510 call c7620 33->35 36 14b20a-14b238 GetCurrentDirectoryW call dfe0b GetCurrentDirectoryW 33->36 34->20 35->36 50 14b1ff-14b208 call e4963 35->50 45 14b23c 36->45 48 14b240-14b244 45->48 51 14b275-14b285 call 1300d9 48->51 52 14b246-14b270 call c9c6e * 3 48->52 50->36 50->51 64 14b287-14b289 51->64 65 14b28b-14b2e1 call 1307c0 call 1306e6 call 1305a7 51->65 52->51 68 14b2ee-14b2f2 64->68 65->68 96 14b2e3 65->96 70 14b2f8-14b321 call 1211c8 68->70 71 14b39a-14b3be CreateProcessW 68->71 85 14b323-14b328 call 121201 70->85 86 14b32a call 1214ce 70->86 78 14b3c1-14b3d4 call dfe14 * 2 71->78 101 14b3d6-14b3e8 78->101 102 14b42f-14b43d CloseHandle 78->102 80->45 81->80 107 14b197-14b1a0 call e4963 81->107 100 14b32f-14b33c call e4963 85->100 86->100 96->68 115 14b347-14b357 call e4963 100->115 116 14b33e-14b345 100->116 105 14b3ed-14b3fc 101->105 106 14b3ea 101->106 109 14b49c 102->109 110 14b43f-14b444 102->110 111 14b401-14b42a GetLastError call c630c call ccfa0 105->111 112 14b3fe 105->112 106->105 107->48 107->80 113 14b4a0-14b4a4 109->113 117 14b446-14b44c CloseHandle 110->117 118 14b451-14b456 110->118 130 14b4e5-14b4f6 call 130175 111->130 112->111 122 14b4a6-14b4b0 113->122 123 14b4b2-14b4bc 113->123 133 14b362-14b372 call e4963 115->133 134 14b359-14b360 115->134 116->115 116->116 117->118 119 14b463-14b468 118->119 120 14b458-14b45e CloseHandle 118->120 127 14b475-14b49a call 1309d9 call 14b536 119->127 128 14b46a-14b470 CloseHandle 119->128 120->119 122->130 131 14b4c4-14b4e3 call ccfa0 CloseHandle 123->131 132 14b4be 123->132 127->113 128->127 131->130 132->131 146 14b374-14b37b 133->146 147 14b37d-14b398 call dfe14 * 3 133->147 134->133 134->134 146->146 146->147 147->78
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0014B198
                                                                                                                                                                                                                                                                                                                                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0014B1B0
                                                                                                                                                                                                                                                                                                                                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0014B1D4
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0014B200
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0014B214
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0014B236
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0014B332
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001305A7: GetStdHandle.KERNEL32(000000F6), ref: 001305C6
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0014B34B
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0014B366
                                                                                                                                                                                                                                                                                                                                                                          • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0014B3B6
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(00000000), ref: 0014B407
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 0014B439
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 0014B44A
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 0014B45C
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 0014B46E
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 0014B4E3
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2178637699-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 70fd7df61b490fb13e645b9161e8cb3a9c9290fcdd1e8b97442cc4c8dfc9d97d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 57007b457383b4ece040b3c5ecc82f850602d4a5b9f61c2d314e7d55f49cdb79
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 70fd7df61b490fb13e645b9161e8cb3a9c9290fcdd1e8b97442cc4c8dfc9d97d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4BF18B316083409FC714EF24C891B6EBBE5BF85714F18855DF89A9B2A2CB71EC45CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 000CD730 Relevance: 21.6, APIs: 14, Instructions: 631windowsleeptimeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetInputState.USER32 ref: 000CD807
                                                                                                                                                                                                                                                                                                                                                                          • timeGetTime.WINMM ref: 000CDA07
                                                                                                                                                                                                                                                                                                                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000CDB28
                                                                                                                                                                                                                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 000CDB7B
                                                                                                                                                                                                                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 000CDB89
                                                                                                                                                                                                                                                                                                                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000CDB9F
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(0000000A), ref: 000CDBB1
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2189390790-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d12400f81316b7c5f2ae880c2d0cf32320a901375b6602317e7202017fe91600
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 55cee646107b16d88bcb72dce43a50625d4022677e09d370cec81926d059cb38
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d12400f81316b7c5f2ae880c2d0cf32320a901375b6602317e7202017fe91600
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2642AE30608342EFD728DF24C885FAEB7E1BF86304F14456EE5568B692D770A894DB92
                                                                                                                                                                                                                                                                                                                                                                          Function 000C2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 000C2D07
                                                                                                                                                                                                                                                                                                                                                                          • RegisterClassExW.USER32(00000030), ref: 000C2D31
                                                                                                                                                                                                                                                                                                                                                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000C2D42
                                                                                                                                                                                                                                                                                                                                                                          • InitCommonControlsEx.COMCTL32(?), ref: 000C2D5F
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000C2D6F
                                                                                                                                                                                                                                                                                                                                                                          • LoadIconW.USER32(000000A9), ref: 000C2D85
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 000C2D94
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2914291525-1005189915
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 67de3d04cbce7eaac04c98d75b28353ac3b286e51f674e27bc55d62b0453c15d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: be21fe7e0f91b3c0d721edfd9c1b17c86909716ac55c3459bb1d50b7e0575016
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 67de3d04cbce7eaac04c98d75b28353ac3b286e51f674e27bc55d62b0453c15d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C621F2B5901309EFDB00DFA4EC89BDDBBB4FB08706F00811AF911AAAA0D7B10584CF90
                                                                                                                                                                                                                                                                                                                                                                          Function 0010065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 457 10065b-10068b call 10042f 460 1006a6-1006b2 call f5221 457->460 461 10068d-100698 call ef2c6 457->461 466 1006b4-1006c9 call ef2c6 call ef2d9 460->466 467 1006cb-100714 call 10039a 460->467 468 10069a-1006a1 call ef2d9 461->468 466->468 476 100781-10078a GetFileType 467->476 477 100716-10071f 467->477 478 10097d-100983 468->478 479 1007d3-1007d6 476->479 480 10078c-1007bd GetLastError call ef2a3 CloseHandle 476->480 482 100721-100725 477->482 483 100756-10077c GetLastError call ef2a3 477->483 486 1007d8-1007dd 479->486 487 1007df-1007e5 479->487 480->468 494 1007c3-1007ce call ef2d9 480->494 482->483 488 100727-100754 call 10039a 482->488 483->468 491 1007e9-100837 call f516a 486->491 487->491 492 1007e7 487->492 488->476 488->483 499 100847-10086b call 10014d 491->499 500 100839-100845 call 1005ab 491->500 492->491 494->468 507 10086d 499->507 508 10087e-1008c1 499->508 500->499 506 10086f-100879 call f86ae 500->506 506->478 507->506 510 1008e2-1008f0 508->510 511 1008c3-1008c7 508->511 514 1008f6-1008fa 510->514 515 10097b 510->515 511->510 513 1008c9-1008dd 511->513 513->510 514->515 516 1008fc-10092f CloseHandle call 10039a 514->516 515->478 519 100931-10095d GetLastError call ef2a3 call f5333 516->519 520 100963-100977 516->520 519->520 520->515
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0010039A: CreateFileW.KERNELBASE(00000000,00000000,?,00100704,?,?,00000000,?,00100704,00000000,0000000C), ref: 001003B7
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0010076F
                                                                                                                                                                                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 00100776
                                                                                                                                                                                                                                                                                                                                                                          • GetFileType.KERNELBASE(00000000), ref: 00100782
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0010078C
                                                                                                                                                                                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 00100795
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 001007B5
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 001008FF
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00100931
                                                                                                                                                                                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 00100938
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                                                                                                                                                                                                                          • String ID: H
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4237864984-2852464175
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 25838155a07724deea7506e28cf2246fd269850ebacd07b7104b1603ccda9686
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 1323a7bc6bad1d214352c7f7926564c9b0b1155769eef22b43f1cade7152fca9
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 25838155a07724deea7506e28cf2246fd269850ebacd07b7104b1603ccda9686
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86A12732A002488FDF1AAF68DC51BAD7BA0EB0A320F14415EF855AF3D2D7759D52CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 000C344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00191418,?,000C2E7F,?,?,?,00000000), ref: 000C3A78
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 000C3379
                                                                                                                                                                                                                                                                                                                                                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 000C356A
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0010318D
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 001031CE
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 00103210
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00103277
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00103286
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 98802146-2727554177
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8e5e8ccf75d2bfc5ede227b4fb85a11127e1f6a952c7fdb8c1ff7598b4bacb6c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: af32e742863418d70d3f016eeb32dd102594d11a6e200a039f543b555654bf6b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e5e8ccf75d2bfc5ede227b4fb85a11127e1f6a952c7fdb8c1ff7598b4bacb6c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5471A171505301AEC314DF25DC82DAFBBE8FF89340F40452EF495971A1EB709A88CBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 000C2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 000C2B8E
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 000C2B9D
                                                                                                                                                                                                                                                                                                                                                                          • LoadIconW.USER32(00000063), ref: 000C2BB3
                                                                                                                                                                                                                                                                                                                                                                          • LoadIconW.USER32(000000A4), ref: 000C2BC5
                                                                                                                                                                                                                                                                                                                                                                          • LoadIconW.USER32(000000A2), ref: 000C2BD7
                                                                                                                                                                                                                                                                                                                                                                          • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 000C2BEF
                                                                                                                                                                                                                                                                                                                                                                          • RegisterClassExW.USER32(?), ref: 000C2C40
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C2CD4: GetSysColorBrush.USER32(0000000F), ref: 000C2D07
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C2CD4: RegisterClassExW.USER32(00000030), ref: 000C2D31
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000C2D42
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C2CD4: InitCommonControlsEx.COMCTL32(?), ref: 000C2D5F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000C2D6F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C2CD4: LoadIconW.USER32(000000A9), ref: 000C2D85
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 000C2D94
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: #$0$AutoIt v3
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 423443420-4155596026
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: f4e985a3e25f49e24d66b73e1dff63fd20246cfa61c166f0e8fd7e89ed860d6c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: fe26e3582c81eb33e1c8bf37f8c71140ac77193b9c675fbedcdc58c8f1bc6d6e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f4e985a3e25f49e24d66b73e1dff63fd20246cfa61c166f0e8fd7e89ed860d6c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 24210770E10319BFDB109FA5EC95AAD7FB4FB48B60F04412BE504A6AA0D7B516C0CF90
                                                                                                                                                                                                                                                                                                                                                                          Function 000C3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 598 c3170-c3185 599 c31e5-c31e7 598->599 600 c3187-c318a 598->600 599->600 601 c31e9 599->601 602 c318c-c3193 600->602 603 c31eb 600->603 604 c31d0-c31d8 DefWindowProcW 601->604 607 c3199-c319e 602->607 608 c3265-c326d PostQuitMessage 602->608 605 102dfb-102e23 call c18e2 call de499 603->605 606 c31f1-c31f6 603->606 615 c31de-c31e4 604->615 644 102e28-102e2f 605->644 610 c321d-c3244 SetTimer RegisterWindowMessageW 606->610 611 c31f8-c31fb 606->611 613 c31a4-c31a8 607->613 614 102e7c-102e90 call 12bf30 607->614 609 c3219-c321b 608->609 609->615 610->609 619 c3246-c3251 CreatePopupMenu 610->619 616 102d9c-102d9f 611->616 617 c3201-c3214 KillTimer call c30f2 call c3c50 611->617 620 c31ae-c31b3 613->620 621 102e68-102e72 call 12c161 613->621 614->609 639 102e96 614->639 623 102da1-102da5 616->623 624 102dd7-102df6 MoveWindow 616->624 617->609 619->609 628 c31b9-c31be 620->628 629 102e4d-102e54 620->629 635 102e77 621->635 631 102dc6-102dd2 SetFocus 623->631 632 102da7-102daa 623->632 624->609 637 c31c4-c31ca 628->637 638 c3253-c3263 call c326f 628->638 629->604 633 102e5a-102e63 call 120ad7 629->633 631->609 632->637 640 102db0-102dc1 call c18e2 632->640 633->604 635->609 637->604 637->644 638->609 639->604 640->609 644->604 648 102e35-102e48 call c30f2 call c3837 644->648 648->604
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,000C316A,?,?), ref: 000C31D8
                                                                                                                                                                                                                                                                                                                                                                          • KillTimer.USER32(?,00000001,?,?,?,?,?,000C316A,?,?), ref: 000C3204
                                                                                                                                                                                                                                                                                                                                                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000C3227
                                                                                                                                                                                                                                                                                                                                                                          • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,000C316A,?,?), ref: 000C3232
                                                                                                                                                                                                                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 000C3246
                                                                                                                                                                                                                                                                                                                                                                          • PostQuitMessage.USER32(00000000), ref: 000C3267
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                                                                                                                                                                                                                                                                                                          • String ID: TaskbarCreated
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 129472671-2362178303
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: cb46c58e6f1c2bbcd426eaec965165d7bafa7c7d0d5f2b07c52a5e548869d478
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cd355492a345d4dfcc7de5553b5c1b6df36b864a425c3d3cd418806d0746e26f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cb46c58e6f1c2bbcd426eaec965165d7bafa7c7d0d5f2b07c52a5e548869d478
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CF41F835264305BEDF251B789D0EFBD3A65E709354F08811EF90196992CB718EC09BA1
                                                                                                                                                                                                                                                                                                                                                                          Function 0012B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 654 12b12f-12b13c 655 12b148-12b15d GetCurrentThreadId 654->655 656 12b13e-12b142 654->656 658 12b163-12b186 GetForegroundWindow GetWindowThreadProcessId AttachThreadInput 655->658 659 12b1ea-12b1f2 655->659 656->655 657 12b220-12b223 656->657 662 12b1c0 658->662 663 12b188-12b1a0 GetWindowThreadProcessId 658->663 660 12b214 659->660 661 12b1f4-12b20c AttachThreadInput 659->661 664 12b219-12b21d AttachThreadInput 660->664 661->664 665 12b20e-12b212 AttachThreadInput 661->665 668 12b1c3-12b1c7 662->668 666 12b1a2-12b1af AttachThreadInput 663->666 667 12b1b4-12b1be AttachThreadInput 663->667 670 12b21f 664->670 665->660 666->667 667->668 669 12b1c9-12b1cd 668->669 668->670 669->670 671 12b1cf-12b1d1 669->671 670->657 671->670 672 12b1d3-12b1da 671->672 672->670 673 12b1dc-12b1e2 672->673 673->670 674 12b1e4-12b1e8 673->674 674->670
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0012B151
                                                                                                                                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32(00000000,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B165
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 0012B16C
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B17B
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 0012B18D
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B1A6
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B1B8
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B1FD
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B212
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0012A1E1,?,00000001), ref: 0012B21D
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2156557900-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: ce6ce91d7e0a40c5bf98e1defffd55e89edd840974f165ba5ad9ac37fe9e1282
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 1b4a304dbdd65811d61518f5bfa29920f329e0232cb87178a1fbf0754cbc6ab4
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ce6ce91d7e0a40c5bf98e1defffd55e89edd840974f165ba5ad9ac37fe9e1282
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB319C75514314FFDB10DF24EC88B7EBBA9BB51312F144006FA11DA691D7B4AAA0CFA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000C2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 685 c2c63-c2cd3 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 000C2C91
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 000C2CB2
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,?,?,?,?,?,?,000C1CAD,?), ref: 000C2CC6
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,?,?,?,?,?,?,000C1CAD,?), ref: 000C2CCF
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$CreateShow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: AutoIt v3$edit
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1584632944-3779509399
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c2a1766012652c63616c3f8a17f2384799addf727d85c704eb20f6d8e0103e20
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 555858e77866bac33c99a308619502770e0a3a0de833dc73a82619dd23d1d54b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c2a1766012652c63616c3f8a17f2384799addf727d85c704eb20f6d8e0103e20
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C7F0DA75540391BEEB311B27AC08E773EBDE7CAF61B00005AFD14A69A0C67119D4DAB1
                                                                                                                                                                                                                                                                                                                                                                          Function 00122F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00122DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00122DC5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00122DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00122DD6
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00122DA7: GetCurrentThreadId.KERNEL32 ref: 00122DDD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00122DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00122DE4
                                                                                                                                                                                                                                                                                                                                                                          • GetFocus.USER32 ref: 00122F78
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00122DEE: GetParent.USER32(00000000), ref: 00122DF9
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00122FC3
                                                                                                                                                                                                                                                                                                                                                                          • EnumChildWindows.USER32(?,0012303B), ref: 00122FEB
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %s%d
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1272988791-1110647743
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 136d2123c2a548f9963da30c590a623b0fff2486d091bb46ef6446261c4c9e76
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 29ee919053ab3be76429d9a3aef2dd747c3e7158eaece97f74d3d6217bae698d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 136d2123c2a548f9963da30c590a623b0fff2486d091bb46ef6446261c4c9e76
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B511E471200319ABCF14BFB09C95EEE37AAAF94304F044079F9199B252DF349A598B70
                                                                                                                                                                                                                                                                                                                                                                          Function 000C3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                                                                                                                                          control_flow_graph 859 c3b1c-c3b27 860 c3b99-c3b9b 859->860 861 c3b29-c3b2e 859->861 862 c3b8c-c3b8f 860->862 861->860 863 c3b30-c3b48 RegOpenKeyExW 861->863 863->860 864 c3b4a-c3b69 RegQueryValueExW 863->864 865 c3b6b-c3b76 864->865 866 c3b80-c3b8b RegCloseKey 864->866 867 c3b78-c3b7a 865->867 868 c3b90-c3b97 865->868 866->862 869 c3b7e 867->869 868->869 869->866
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,000C3B0F,SwapMouseButtons,00000004,?), ref: 000C3B40
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,000C3B0F,SwapMouseButtons,00000004,?), ref: 000C3B61
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,000C3B0F,SwapMouseButtons,00000004,?), ref: 000C3B83
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Control Panel\Mouse
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3677997916-824357125
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 97fb02fb39f1050f6d84a9fb68eb34c8ed1313218f22f1c37adb634a02781225
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f4b6254dbcab8f999431eebd78de3660539647761d391235f085f1c03dc3d8bd
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 97fb02fb39f1050f6d84a9fb68eb34c8ed1313218f22f1c37adb634a02781225
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 66112AB5520208FFDB608FA5DC44EEFB7BCEF44755B108459BA05D7150D3319E409BA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0012AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 0012ABF1
                                                                                                                                                                                                                                                                                                                                                                          • SetKeyboardState.USER32(00000080,?,00008000), ref: 0012AC0D
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000101,00000000), ref: 0012AC74
                                                                                                                                                                                                                                                                                                                                                                          • SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 0012ACC6
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: KeyboardState$InputMessagePostSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 432972143-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 00f57bd0e99bfecb1bd56951bce020a3ef84535ed25c8a38cc74487627c7cd24
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f4af0d687ffba7f4fffba653c7e76c2b9bd81ed11d6b7b080cb0c1110595987c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 00f57bd0e99bfecb1bd56951bce020a3ef84535ed25c8a38cc74487627c7cd24
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB312830A04328AFFF38CF64EC047FE7BA5AF85310F84421AE481562D1C3749AB58792
                                                                                                                                                                                                                                                                                                                                                                          Function 0012B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0012ACD3,?,00008000), ref: 0012B0C4
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000000,?,?,?,?,?,?,?,?,0012ACD3,?,00008000), ref: 0012B0E9
                                                                                                                                                                                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0012ACD3,?,00008000), ref: 0012B0F3
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0012ACD3,?,00008000), ref: 0012B126
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CounterPerformanceQuerySleep
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2875609808-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 127bae2073eef5212a4aec2389173524c9b03542aa48fa38a4bda71aba130080
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8b604d23a39c10258e0c71522f56c6206ee31d21a667480fc0f9c3630310d499
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 127bae2073eef5212a4aec2389173524c9b03542aa48fa38a4bda71aba130080
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0E113C71C05A39DBCF04AFA4F9A86EEBB78FF09711F114085D941B6141CB3056608B95
                                                                                                                                                                                                                                                                                                                                                                          Function 00122DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00122DC5
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00122DD6
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00122DDD
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00122DE4
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2710830443-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: fe62b11faf6eebfd1ff1998d2e3d8a3bbba2f1127e531f70895fa90fb17243ff
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5380fb42fb313400a98b59ace4d83c881a7bb8eea34c155c187364d76db16aaa
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe62b11faf6eebfd1ff1998d2e3d8a3bbba2f1127e531f70895fa90fb17243ff
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 50E06D72101338BBD7201BB2AC0DEEB3E6CEB42BA2F000015F105D95809AA48980C6F0
                                                                                                                                                                                                                                                                                                                                                                          Function 000C3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 001033A2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A
                                                                                                                                                                                                                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 000C3A04
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: IconLoadNotifyShell_String_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Line:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2289894680-1585850449
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: faf099b89b40d2714237635b94ed07e1149c3e9efa287b5a93bccc10875bdd4d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d24c7d4d8b9e56d99962dacae7caeb79f1e62206e2ea377e4b29f5604a9d7308
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: faf099b89b40d2714237635b94ed07e1149c3e9efa287b5a93bccc10875bdd4d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8431C171518305AED725EB20DC46FEFB7E8AB40720F00892EF59993592DB709B89C7C2
                                                                                                                                                                                                                                                                                                                                                                          Function 000DFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 000E0668
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E32A4: RaiseException.KERNEL32(?,?,?,000E068A,?,00191444,?,?,?,?,?,?,000E068A,000C1129,00188738,000C1129), ref: 000E3304
                                                                                                                                                                                                                                                                                                                                                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 000E0685
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Exception@8Throw$ExceptionRaise
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Unknown exception
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3476068407-410509341
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b06d04894ea6a105c62441d2c69f723268eb860d3695cb2dd364b2cc5ba140c0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 42c8da9bfb702ed683406a43a58495406c7d7ef068cf3c2404e29fc82b78b6bc
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b06d04894ea6a105c62441d2c69f723268eb860d3695cb2dd364b2cc5ba140c0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D2F0C83490038DBBCB10B666D846DDE7BBD5F40310BA04535B924F65D2EFB1DB55CA90
                                                                                                                                                                                                                                                                                                                                                                          Function 000C10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 000C1BF4
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 000C1BFC
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 000C1C07
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 000C1C12
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 000C1C1A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 000C1C22
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C1B4A: RegisterWindowMessageW.USER32(00000004,?,000C12C4), ref: 000C1BA2
                                                                                                                                                                                                                                                                                                                                                                          • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 000C136A
                                                                                                                                                                                                                                                                                                                                                                          • OleInitialize.OLE32 ref: 000C1388
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,00000000), ref: 001024AB
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1986988660-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 255e64accd2c28844879f1896aaa154d86f47f5b771580fcaf2d83d02006b13e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 51b19cdaaf0505a943bdb5370a3129b00d8625052b37545a85874a1a374d7769
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 255e64accd2c28844879f1896aaa154d86f47f5b771580fcaf2d83d02006b13e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B271CFB4901303AFE785DF79AA45A993AE1FB8A344357822FD41AD7B62EB3044C5CF41
                                                                                                                                                                                                                                                                                                                                                                          Function 0012C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 000C3A04
                                                                                                                                                                                                                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0012C259
                                                                                                                                                                                                                                                                                                                                                                          • KillTimer.USER32(?,00000001,?,?), ref: 0012C261
                                                                                                                                                                                                                                                                                                                                                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0012C270
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: IconNotifyShell_Timer$Kill
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3500052701-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8a57c42460f05bc92858ea1b29bfbdb8a09aef5f65e4c4ab187d88713807e86e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5cf572107fb08a5f805b10cee61c0099c0c8c9fc1a1d09e2f70ac94921ee6cfc
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8a57c42460f05bc92858ea1b29bfbdb8a09aef5f65e4c4ab187d88713807e86e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB31C570904354EFEB26DF64A855BEBBBECAF16304F00049ED2DA97241C7745A84CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 000F86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNELBASE(00000000,00000000,?,?,000F85CC,?,00188CC8,0000000C), ref: 000F8704
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,000F85CC,?,00188CC8,0000000C), ref: 000F870E
                                                                                                                                                                                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 000F8739
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CloseErrorHandleLast__dosmaperr
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2583163307-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a28971cf563fc162dbc94362d74cb1ba01aff939504861363a9b69eadb4b444d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d7169c14a8ec4a80ba0a944bd0e38212085f0bfae8e6ab91dc2ad744c60cd834
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a28971cf563fc162dbc94362d74cb1ba01aff939504861363a9b69eadb4b444d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2E014C336047285AC2A062346C497FE37C54B82779F254119EB04DB9D3DE60CD81A390
                                                                                                                                                                                                                                                                                                                                                                          Function 000CDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 000CDB7B
                                                                                                                                                                                                                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 000CDB89
                                                                                                                                                                                                                                                                                                                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000CDB9F
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(0000000A), ref: 000CDBB1
                                                                                                                                                                                                                                                                                                                                                                          • TranslateAcceleratorW.USER32(?,?,?), ref: 00111CC9
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Message$Translate$AcceleratorDispatchPeekSleep
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3288985973-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 65cc1173bde993173c4c3bedad73afbd2bc4109abb64ba1bb540f94fbc09ae33
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 506f5838a1ee4ef7f8c55fc901c628f66792f0d6e46a70e4bec5a621fc9da3e3
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 65cc1173bde993173c4c3bedad73afbd2bc4109abb64ba1bb540f94fbc09ae33
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33F05430644381EBE734CB60CC45FDE73ACEB44311F504529E60A874C0DB3094C89B65
                                                                                                                                                                                                                                                                                                                                                                          Function 000D1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • __Init_thread_footer.LIBCMT ref: 000D17F6
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Init_thread_footer
                                                                                                                                                                                                                                                                                                                                                                          • String ID: CALL
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1385522511-4196123274
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4da57e27bf0dfcbecb692396e0ff8e406983619eda8dd61ad5c8175468e6337a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 308528c44cec28ed306c58f38d0e974840aa8552e43bc58a9241bddc3e1cd597
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4da57e27bf0dfcbecb692396e0ff8e406983619eda8dd61ad5c8175468e6337a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F1228E70608301EFC714DF14D484AAABBF1BF85314F14856EF49A8B362DB76E985CB62
                                                                                                                                                                                                                                                                                                                                                                          Function 000C2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetOpenFileNameW.COMDLG32(?), ref: 00102C8C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000C3A97,?,?,000C2E7F,?,?,?,00000000), ref: 000C3AC2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000C2DC4
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Name$Path$FileFullLongOpen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: X
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 779396738-3081909835
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8949581d72b05628e57ca6a6395ab7691f592e379477b4a7e28ea09b654f0b43
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3f137b3d2f21d416521dda66e55c7defd06fe712f4accad0d8fffebac898d2bd
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8949581d72b05628e57ca6a6395ab7691f592e379477b4a7e28ea09b654f0b43
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2217571A102589FDB11EF94C849BEE7BFCAF49314F00805DE545BB281DBF45A898FA1
                                                                                                                                                                                                                                                                                                                                                                          Function 000C3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(00000000,?), ref: 000C3908
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: IconNotifyShell_
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1144537725-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e9518a028b3783e991c15940804d047f04c89f54857e8176bc306f8daf2380ac
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e996329e0dbd43ae21edc3b36fa6cb3e57f568df8d932491f2e056a3fa39fd41
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e9518a028b3783e991c15940804d047f04c89f54857e8176bc306f8daf2380ac
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8A319170504301DFD760DF24D885B9BBBF8FB49718F00092EF59987680E7B1AA88CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 000DF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • timeGetTime.WINMM ref: 000DF661
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000CD730: GetInputState.USER32 ref: 000CD807
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000), ref: 0011F2DE
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: InputSleepStateTimetime
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4149333218-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a23f3370bd8bf8b18b412fbe6aaae35537c49ad87ee97f5085cec2f39e5fb4ab
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e783cd76d78ac6c69b983e8aa0766d0bf1cdd9883ffe9d30566ca50c1ae58ff6
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a23f3370bd8bf8b18b412fbe6aaae35537c49ad87ee97f5085cec2f39e5fb4ab
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EFF05831240B059FD314EF69D44AFAEB7E8AB59761F00402AF85ACB7A1DB70A8408B90
                                                                                                                                                                                                                                                                                                                                                                          Function 000CB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • __Init_thread_footer.LIBCMT ref: 000CBB4E
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Init_thread_footer
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1385522511-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5b268de1cbb0d5d3e23be15d1b637e02bd8e38ce239be8dc1febe6f2d4f75033
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f9378a0d6214b1129e4a7bcdb8cfa59961e70530dd6cfae57127ea7de0947396
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5b268de1cbb0d5d3e23be15d1b637e02bd8e38ce239be8dc1febe6f2d4f75033
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C328D34A04209AFDB29CF54C895FBEB7B9FF48310F15806AE915AB251C7B4EE81CB51
                                                                                                                                                                                                                                                                                                                                                                          Function 000C4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,000C4EDD,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E9C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 000C4EAE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C4E90: FreeLibrary.KERNEL32(00000000,?,?,000C4EDD,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4EC0
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4EFD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00103CDE,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E62
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 000C4E74
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C4E59: FreeLibrary.KERNEL32(00000000,?,?,00103CDE,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E87
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Library$Load$AddressFreeProc
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2632591731-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c64c41c966566ad2551665c1671b301869ca6e63b9c072a77b934046f1b3675d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 82070dd278fd2c6fec7ff5b1fd63f1653bbd557ffe39849652b8979407b5d51b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c64c41c966566ad2551665c1671b301869ca6e63b9c072a77b934046f1b3675d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D511E332610305AADB24FF60DC22FED77A5AF50711F20842EF552AA1D2EFB1AA459790
                                                                                                                                                                                                                                                                                                                                                                          Function 000F8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: __wsopen_s
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3347428461-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 544b0cd8e59c201a4d4f0d914284f9386aa8299b636b69c2cd36c4c31226f002
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c98f3178f9e28ae50027352d5168cd0601d15c8055f37839926cfd85a56b326c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 544b0cd8e59c201a4d4f0d914284f9386aa8299b636b69c2cd36c4c31226f002
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5211487590410AAFCB05DF58E9419EE7BF8FF48304F148059F908AB312DB30EA11DBA4
                                                                                                                                                                                                                                                                                                                                                                          Function 000F5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F4C7D: RtlAllocateHeap.NTDLL(00000008,000C1129,00000000,?,000F2E29,00000001,00000364,?,?,?,000EF2DE,000F3863,00191444,?,000DFDF5,?), ref: 000F4CBE
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F506C
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AllocateHeap_free
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 614378929-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 74932b80cf2b035b94cf5a32ffa1ad7aca3a2fb769e3c7e1623b3d332a376451
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 91014E722047095BE3318F55DC459AAFBECFB85370F25051DE794836C1EA706805C7B4
                                                                                                                                                                                                                                                                                                                                                                          Function 000EE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f581a561ca329b3a9bce4854d4037c4476bd8fa2bf7fe93f7032546f97956e43
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 81F0F432511A9C9ECA313A6BDC05BEA33989F523B4F100716FA20B35D3DB70D80196A5
                                                                                                                                                                                                                                                                                                                                                                          Function 000F4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • RtlAllocateHeap.NTDLL(00000008,000C1129,00000000,?,000F2E29,00000001,00000364,?,?,?,000EF2DE,000F3863,00191444,?,000DFDF5,?), ref: 000F4CBE
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a3571135a1dd7114326b77d20622eaf5a8b80f74dd9b12620206994daa30f7b5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5ab14480cdc7a3ee8c19fb5a5a7ece19f40ab6e6c73c5a50b06646613d6a9d79
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a3571135a1dd7114326b77d20622eaf5a8b80f74dd9b12620206994daa30f7b5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6FF0BB3150226C6ADBA15F629C05B7B37D8BF41761B145125BF19A7A81CA30D80065D0
                                                                                                                                                                                                                                                                                                                                                                          Function 000F3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: dcbf13906800e252306d2841bf747753c0ac3232d4fe320570f822de82ff811f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 83955f0597e0c6aab9be7531c696f51e6a4da2896ce8deffb275a942b3965516
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dcbf13906800e252306d2841bf747753c0ac3232d4fe320570f822de82ff811f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5CE0E53110036DAAD6712A779D01BFA36C8AB42BF0F090021BE04A6E81DF19DE03A1E0
                                                                                                                                                                                                                                                                                                                                                                          Function 000C4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4F6D
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FreeLibrary
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3664257935-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 40b4ded9df539fc131fac9c3a57e49c25021a966966fcb8cbda6cf08cbdf73d1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9fe2efde7b695aad62b140791c359ee0754f92812b66b0fa0f9f41747cccc1f0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 40b4ded9df539fc131fac9c3a57e49c25021a966966fcb8cbda6cf08cbdf73d1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5EF03971105752CFDB349F64D4A0E6ABBE4BF14329320897EE1EA82621CB319885DF50
                                                                                                                                                                                                                                                                                                                                                                          Function 00152A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • IsWindow.USER32(00000000), ref: 00152A66
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2353593579-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 55601fda02ff09615281772897f97574462f25665a50d52cbdc349caef2212ff
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 98325035840a1135c2744baa49719cfd6adcfea0b5b3b1b6c35500fb2426e304
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 55601fda02ff09615281772897f97574462f25665a50d52cbdc349caef2212ff
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ACE04F36354226EBC718EA30EC808FA735CEB65396B104536EC26CB540DB349AA986E0
                                                                                                                                                                                                                                                                                                                                                                          Function 000C2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000C2DC4
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: LongNamePath_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 541455249-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 02d332c0da421b48bf0fb589910e83e5456f9ad59d0677da3677dd8a1573942f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8eeb0c6cbfad30ec64d43f42d9a94b49a7cbd55a8abe81d4788ed978a1c7198f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 02d332c0da421b48bf0fb589910e83e5456f9ad59d0677da3677dd8a1573942f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37E0C272A002246BCB20E7989C06FEA77EDDFC8790F0400B5FD09E7248DAA4ADC48690
                                                                                                                                                                                                                                                                                                                                                                          Function 000C2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 000C3908
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000CD730: GetInputState.USER32 ref: 000CD807
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 000C2B6B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 000C314E
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: IconNotifyShell_$CurrentDirectoryInputState
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3667716007-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 63f3bd178bdc9df5ad986a2ab63ac16f4c3110151dd59bd000fee8ffebb7c8ef
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: be1fc837e0f7f3d01c25b24c65a8b706fe8941f4676c93dc0b1eb71c3887bf43
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 63f3bd178bdc9df5ad986a2ab63ac16f4c3110151dd59bd000fee8ffebb7c8ef
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 26E0862230434516CA04BB74A856FFDB7599BD5351F40553EF142471A3DF2489CA4251
                                                                                                                                                                                                                                                                                                                                                                          Function 0010039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateFileW.KERNELBASE(00000000,00000000,?,00100704,?,?,00000000,?,00100704,00000000,0000000C), ref: 001003B7
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CreateFile
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 823142352-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b361be10b0e00002bae87d68e464da797d7746894510e8ec70cf6ac496f1c008
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2e89f02ddee3c7705cc33bc6bc8e645745fc4774387fc3c987b322dc5e6a8ec4
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b361be10b0e00002bae87d68e464da797d7746894510e8ec70cf6ac496f1c008
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8CD06C3204020DFFDF029F84DD46EDA3BAAFB48714F014000BE185A020C732E861AB90
                                                                                                                                                                                                                                                                                                                                                                          Function 000C1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 000C1CBC
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: InfoParametersSystem
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3098949447-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b09a23bbbe24cd81e790c24804f3d509a3bf5a94f209aa1b9b9955293ddc6caa
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6786e4fb22ba81df57cf4a6fd9f2fd0cfbc65183e2e0fd3c039f356b7d2295b6
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b09a23bbbe24cd81e790c24804f3d509a3bf5a94f209aa1b9b9955293ddc6caa
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6EC0483A380306AEF2148B90AC4AF507764A348B11F448002F619A99E392B228A0EA90

                                                                                                                                                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                                          Function 00159576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0015961A
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0015965B
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0015969F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001596C9
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32 ref: 001596F2
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 0015978B
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(00000009), ref: 00159798
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 001597AE
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(00000010), ref: 001597B8
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001597E9
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32 ref: 00159810
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001030,?,00157E95), ref: 00159918
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0015992E
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00159941
                                                                                                                                                                                                                                                                                                                                                                          • SetCapture.USER32(?), ref: 0015994A
                                                                                                                                                                                                                                                                                                                                                                          • ClientToScreen.USER32(?,?), ref: 001599AF
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 001599BC
                                                                                                                                                                                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001599D6
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseCapture.USER32 ref: 001599E1
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00159A19
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00159A26
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 00159A80
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32 ref: 00159AAE
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 00159AEB
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32 ref: 00159B1A
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00159B3B
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00159B4A
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00159B68
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00159B75
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32(?), ref: 00159B93
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 00159BFA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32 ref: 00159C2B
                                                                                                                                                                                                                                                                                                                                                                          • ClientToScreen.USER32(?,?), ref: 00159C84
                                                                                                                                                                                                                                                                                                                                                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00159CB4
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 00159CDE
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32 ref: 00159D01
                                                                                                                                                                                                                                                                                                                                                                          • ClientToScreen.USER32(?,?), ref: 00159D4E
                                                                                                                                                                                                                                                                                                                                                                          • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00159D82
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9944: GetWindowLongW.USER32(?,000000EB), ref: 000D9952
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00159E05
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                                                                                                                                                                                                                                                                                                                                          • String ID: @GUI_DRAGID$F
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3429851547-4164748364
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 070ad3fa64374542d34f7c9df8966734506f17b141a29ea78ac9a90b8da5c5f0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5d1c605c6e40d2b424feef0e14b729146206454f46baa6e0fa3d669961f9f85b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 070ad3fa64374542d34f7c9df8966734506f17b141a29ea78ac9a90b8da5c5f0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8A429C74204301EFDB25CF24CD44AAABBE5FF48315F10061EF9698B6A1D731A998DF92
                                                                                                                                                                                                                                                                                                                                                                          Function 00154873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 001548F3
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00154908
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00154927
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0015494B
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0015495C
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0015497B
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 001549AE
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 001549D4
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00154A0F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00154A56
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00154A7E
                                                                                                                                                                                                                                                                                                                                                                          • IsMenu.USER32(?), ref: 00154A97
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00154AF2
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00154B20
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00154B94
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00154BE3
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00154C82
                                                                                                                                                                                                                                                                                                                                                                          • wsprintfW.USER32 ref: 00154CAE
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00154CC9
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowTextW.USER32(?,00000000,00000001), ref: 00154CF1
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00154D13
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00154D33
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowTextW.USER32(?,00000000,00000001), ref: 00154D5A
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %d/%02d/%02d
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4054740463-328681919
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 05d5da61146a996f565dc4855a9ba3db547dc2ad506e63177d507cd209d036a7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f6dbd103fef0e1047808425eb319563f75f11c78759474e50ea748510d39a147
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 05d5da61146a996f565dc4855a9ba3db547dc2ad506e63177d507cd209d036a7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F712CF71600314EFEB258F68CC49FEE7BB8EB45719F10411AF926DE2A1DB749A84CB50
                                                                                                                                                                                                                                                                                                                                                                          Function 000DF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 000DF998
                                                                                                                                                                                                                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0011F474
                                                                                                                                                                                                                                                                                                                                                                          • IsIconic.USER32(00000000), ref: 0011F47D
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,00000009), ref: 0011F48A
                                                                                                                                                                                                                                                                                                                                                                          • SetForegroundWindow.USER32(00000000), ref: 0011F494
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0011F4AA
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0011F4B1
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0011F4BD
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(?,00000000,00000001), ref: 0011F4CE
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(?,00000000,00000001), ref: 0011F4D6
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0011F4DE
                                                                                                                                                                                                                                                                                                                                                                          • SetForegroundWindow.USER32(00000000), ref: 0011F4E1
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0011F4F6
                                                                                                                                                                                                                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 0011F501
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0011F50B
                                                                                                                                                                                                                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 0011F510
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0011F519
                                                                                                                                                                                                                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 0011F51E
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0011F528
                                                                                                                                                                                                                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 0011F52D
                                                                                                                                                                                                                                                                                                                                                                          • SetForegroundWindow.USER32(00000000), ref: 0011F530
                                                                                                                                                                                                                                                                                                                                                                          • AttachThreadInput.USER32(?,000000FF,00000000), ref: 0011F557
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4125248594-2988720461
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: fa67de7864ebb8172223bfe342b5ca3bb656711e73e407d3f3b4fb43e5ade5c5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b6074ddf2ee5d394851224cb2c93f1173152f61514ba9bf3f6673b8149705daf
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fa67de7864ebb8172223bfe342b5ca3bb656711e73e407d3f3b4fb43e5ade5c5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D318D71B40318BEEB246FB55C4AFBF7E6DEB44B51F100069FA00EA1D1D7B05981AAA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00121201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0012170D
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0012173A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001216C3: GetLastError.KERNEL32 ref: 0012174A
                                                                                                                                                                                                                                                                                                                                                                          • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00121286
                                                                                                                                                                                                                                                                                                                                                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 001212A8
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 001212B9
                                                                                                                                                                                                                                                                                                                                                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 001212D1
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessWindowStation.USER32 ref: 001212EA
                                                                                                                                                                                                                                                                                                                                                                          • SetProcessWindowStation.USER32(00000000), ref: 001212F4
                                                                                                                                                                                                                                                                                                                                                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00121310
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,001211FC), ref: 001210D4
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210BF: CloseHandle.KERNEL32(?,?,001211FC), ref: 001210E9
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                                                                                                                                                                                                                                                                                                                                          • String ID: $default$winsta0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 22674027-1027155976
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 15bd2d876280e959e27b1c899077076e0c38f36f8a47ecef99fd396a19941052
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a5ec81c4a355613b55f8165e9c946ab9614473473f32ef94565e00f48ed500f4
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 15bd2d876280e959e27b1c899077076e0c38f36f8a47ecef99fd396a19941052
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C481AD71900359BFDF20EFA4EC49BEE7BB9EF14700F144129F915A62A0D7708AA4CB60
                                                                                                                                                                                                                                                                                                                                                                          Function 00120B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00121114
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121120
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 0012112F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121136
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0012114D
                                                                                                                                                                                                                                                                                                                                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00120BCC
                                                                                                                                                                                                                                                                                                                                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00120C00
                                                                                                                                                                                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?), ref: 00120C17
                                                                                                                                                                                                                                                                                                                                                                          • GetAce.ADVAPI32(?,00000000,?), ref: 00120C51
                                                                                                                                                                                                                                                                                                                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00120C6D
                                                                                                                                                                                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?), ref: 00120C84
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00120C8C
                                                                                                                                                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(00000000), ref: 00120C93
                                                                                                                                                                                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00120CB4
                                                                                                                                                                                                                                                                                                                                                                          • CopySid.ADVAPI32(00000000), ref: 00120CBB
                                                                                                                                                                                                                                                                                                                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00120CEA
                                                                                                                                                                                                                                                                                                                                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00120D0C
                                                                                                                                                                                                                                                                                                                                                                          • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00120D1E
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120D45
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 00120D4C
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120D55
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 00120D5C
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120D65
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 00120D6C
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 00120D78
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 00120D7F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121193: GetProcessHeap.KERNEL32(00000008,00120BB1,?,00000000,?,00120BB1,?), ref: 001211A1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00120BB1,?), ref: 001211A8
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00120BB1,?), ref: 001211B7
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4175595110-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e32eff31de3325c9b337da8195d85bfafbac9e399e12f8f8e9c326a62cce97ee
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4c170a9acf8b738c55cc20a3bd803a9d51d08bcdd59c538f5d8ee7bb87b00b32
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e32eff31de3325c9b337da8195d85bfafbac9e399e12f8f8e9c326a62cce97ee
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ED716A7590131AEFDF11DFE4EC44BAEBBB8EF08311F044215F914AA292D771AA55CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0013EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • OpenClipboard.USER32(0015CC08), ref: 0013EB29
                                                                                                                                                                                                                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0013EB37
                                                                                                                                                                                                                                                                                                                                                                          • GetClipboardData.USER32(0000000D), ref: 0013EB43
                                                                                                                                                                                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0013EB4F
                                                                                                                                                                                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0013EB87
                                                                                                                                                                                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0013EB91
                                                                                                                                                                                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0013EBBC
                                                                                                                                                                                                                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0013EBC9
                                                                                                                                                                                                                                                                                                                                                                          • GetClipboardData.USER32(00000001), ref: 0013EBD1
                                                                                                                                                                                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0013EBE2
                                                                                                                                                                                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0013EC22
                                                                                                                                                                                                                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(0000000F), ref: 0013EC38
                                                                                                                                                                                                                                                                                                                                                                          • GetClipboardData.USER32(0000000F), ref: 0013EC44
                                                                                                                                                                                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0013EC55
                                                                                                                                                                                                                                                                                                                                                                          • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0013EC77
                                                                                                                                                                                                                                                                                                                                                                          • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0013EC94
                                                                                                                                                                                                                                                                                                                                                                          • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0013ECD2
                                                                                                                                                                                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0013ECF3
                                                                                                                                                                                                                                                                                                                                                                          • CountClipboardFormats.USER32 ref: 0013ED14
                                                                                                                                                                                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0013ED59
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 420908878-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 20b53fc997128f997d98f04248fc179e4e04ddee1395c0a7ee1dac4b2776ecd8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 64c18a18df515a6f6d969ca9bba311ca4801362ac9f3bb187aacb7dff6a02174
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 20b53fc997128f997d98f04248fc179e4e04ddee1395c0a7ee1dac4b2776ecd8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB61AB34204301AFD310EF64D899F6AB7E4EF84714F14455DF4569B2E2CB71EA85CBA2
                                                                                                                                                                                                                                                                                                                                                                          Function 0013698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 001369BE
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00136A12
                                                                                                                                                                                                                                                                                                                                                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00136A4E
                                                                                                                                                                                                                                                                                                                                                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00136A75
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 00136AB2
                                                                                                                                                                                                                                                                                                                                                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 00136ADF
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3830820486-3289030164
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 61f4dde533c6329b2f8cf03d7b5a7faaa2705fe5aac4350190f344e0bb9cad0c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ae95291748b613a023416962041e84ca580752b6d6bfca8e34f67b561b9f8e14
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 61f4dde533c6329b2f8cf03d7b5a7faaa2705fe5aac4350190f344e0bb9cad0c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 43D14171508340AFC714EBA4C886EAFB7ECAF88704F44491DF589D7192EB74DA49CB62
                                                                                                                                                                                                                                                                                                                                                                          Function 00139642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00139663
                                                                                                                                                                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 001396A1
                                                                                                                                                                                                                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,?), ref: 001396BB
                                                                                                                                                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 001396D3
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 001396DE
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 001396FA
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0013974A
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(00186B7C), ref: 00139768
                                                                                                                                                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00139772
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0013977F
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0013978F
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                                                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1409584000-438819550
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 22cac37931d8a3bd398360795bb55ed5066e73643b7fbc3c96c03bd8f0185c52
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ca328e2ce59952a3fe0ba1af424e2579a1362189401a65fd945e64ebeb9ef132
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 22cac37931d8a3bd398360795bb55ed5066e73643b7fbc3c96c03bd8f0185c52
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1631F13264131AAFDF14AFB4DC49ADE77ACAF09322F144055F915E60E0EBB4DE848E90
                                                                                                                                                                                                                                                                                                                                                                          Function 0013979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 001397BE
                                                                                                                                                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00139819
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00139824
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00139840
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00139890
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(00186B7C), ref: 001398AE
                                                                                                                                                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 001398B8
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 001398C5
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 001398D5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0012DB00
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                                                                                                                                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2640511053-438819550
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5eb7a3c5a5a6d2922a9190e7b573a9ce56da2599c7278b2dcfbfce378315a26a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c4c14ed6f4700d1a6af0bbb87d468a715dab0e2e164c30e89f66f9bf9a11c78f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5eb7a3c5a5a6d2922a9190e7b573a9ce56da2599c7278b2dcfbfce378315a26a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D31D23250035EAEDF10EFB4EC48ADE77ACAF46325F1441A5E950A60A1DBB4DE84CF60
                                                                                                                                                                                                                                                                                                                                                                          Function 0014BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014C9F1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA68
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA9E
                                                                                                                                                                                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014BF3E
                                                                                                                                                                                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0014BFA9
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0014BFCD
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0014C02C
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0014C0E7
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0014C154
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0014C1E9
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0014C23A
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0014C2E3
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0014C382
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0014C38F
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3102970594-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e43868bdf772e1c6f89b4cd20dd0ced4e5e6856601a93cd94c76cff0db682b8f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cd0f45c9572e17e7d7f7db2bce3539f81c6be2cbd2c99906dd394873f8886232
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e43868bdf772e1c6f89b4cd20dd0ced4e5e6856601a93cd94c76cff0db682b8f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B023C716042009FD754DF28C895E2ABBE5EF89318F18C49DF84ACB2A2DB31ED45CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 00138195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetLocalTime.KERNEL32(?), ref: 00138257
                                                                                                                                                                                                                                                                                                                                                                          • SystemTimeToFileTime.KERNEL32(?,?), ref: 00138267
                                                                                                                                                                                                                                                                                                                                                                          • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00138273
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00138310
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00138324
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00138356
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0013838C
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00138395
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CurrentDirectoryTime$File$Local$System
                                                                                                                                                                                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1464919966-438819550
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 695f708c618102c9fefa003003ea0e049d855c4aec3fb4e3b2f2206d6731c6a2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 85d21375b86c2f073419f34e2cc51610a4901858191ae54d321f1c4cf9de86ca
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 695f708c618102c9fefa003003ea0e049d855c4aec3fb4e3b2f2206d6731c6a2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 226169725043459FCB10EF60C841EAEB3E8FF89314F04892EF98997252DB35E949CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 0012D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000C3A97,?,?,000C2E7F,?,?,?,00000000), ref: 000C3AC2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012E199: GetFileAttributesW.KERNEL32(?,0012CF95), ref: 0012E19A
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 0012D122
                                                                                                                                                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0012D1DD
                                                                                                                                                                                                                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0012D1F0
                                                                                                                                                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,?,?), ref: 0012D20D
                                                                                                                                                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0012D237
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0012D21C,?,?), ref: 0012D2B2
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000,?,?,?), ref: 0012D253
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0012D264
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                                                                                                                                                                                                                                                                                                                                          • String ID: \*.*
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1946585618-1173974218
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 32ffe8b08d6dd1e1724e1bb654d641ddf4f5b24a7014128e8be874ef26f8b04b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6f7c3366f8023294738cedc79e3bf108b9ddda3f654fbfb08451f2ee71fd5cbf
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 32ffe8b08d6dd1e1724e1bb654d641ddf4f5b24a7014128e8be874ef26f8b04b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6E615C3190125D9FCF05EBA0EA92EEDB7B5AF15300F608169E40277192EB30AF19CB61
                                                                                                                                                                                                                                                                                                                                                                          Function 0013ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1737998785-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4088ad22b00fe0ec347332d481df1eb305824750531a8d29ae728ec434f22122
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 45ddf7d4db2b3db4d5dd696e289fb0e351c12449a1f439e0f4ed8fc0e9369192
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4088ad22b00fe0ec347332d481df1eb305824750531a8d29ae728ec434f22122
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A416A35604711EFE710DF15D888F5ABBE5EF44329F1480A9E4198FAA2C735ED82CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 0012E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0012170D
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0012173A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001216C3: GetLastError.KERNEL32 ref: 0012174A
                                                                                                                                                                                                                                                                                                                                                                          • ExitWindowsEx.USER32(?,00000000), ref: 0012E932
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                                                                                                                                                                                                                                                                                                                          • String ID: $ $@$SeShutdownPrivilege
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2234035333-3163812486
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 83d9d6c01d07755ec08e1bc4ca280104463bb34e2baf8417bb0ac3c54b601a94
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a89eb6d170ddfca038460e8f77f5ec637d4abc1daa477d6aa957b370952dc7ff
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83d9d6c01d07755ec08e1bc4ca280104463bb34e2baf8417bb0ac3c54b601a94
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9801D672A10331AFEF5466B8BC8ABBF729CA724759F150423F902E61D1E7A05CE4C6D4
                                                                                                                                                                                                                                                                                                                                                                          Function 00141204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00141276
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 00141283
                                                                                                                                                                                                                                                                                                                                                                          • bind.WSOCK32(00000000,?,00000010), ref: 001412BA
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 001412C5
                                                                                                                                                                                                                                                                                                                                                                          • closesocket.WSOCK32(00000000), ref: 001412F4
                                                                                                                                                                                                                                                                                                                                                                          • listen.WSOCK32(00000000,00000005), ref: 00141303
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 0014130D
                                                                                                                                                                                                                                                                                                                                                                          • closesocket.WSOCK32(00000000), ref: 0014133C
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorLast$closesocket$bindlistensocket
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 540024437-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0635fe02fc3b3cbfec56ee985ee150a4c2d7245d7782b03c3ca484fe120e073c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 328f79ed3a120bed43919b1aed8ea51e3b189a4dcc9f1ed55a3d42eb6d1d934c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0635fe02fc3b3cbfec56ee985ee150a4c2d7245d7782b03c3ca484fe120e073c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9D414E31600200AFD714DF64C485F69BBE6BF46318F288198E8569F2A6C771EDC2CBE1
                                                                                                                                                                                                                                                                                                                                                                          Function 000FB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FB9D4
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FB9F8
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FBB7F
                                                                                                                                                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00163700), ref: 000FBB91
                                                                                                                                                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,0019121C,000000FF,00000000,0000003F,00000000,?,?), ref: 000FBC09
                                                                                                                                                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00191270,000000FF,?,0000003F,00000000,?), ref: 000FBC36
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FBD4B
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 314583886-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c2235ffe8cdff44366b8681d5e4e3ac3b95a2be03963ab8625900bb55f7d4aa1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 60b8a71aa092daf4b1a40c9b633c957adf44d5ce45a93aff0c6c1180416903d2
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c2235ffe8cdff44366b8681d5e4e3ac3b95a2be03963ab8625900bb55f7d4aa1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3CC12A7190420DAFCB20EF69DC51ABE7BE9EF41310F24415AE650D7952E7709E41EF90
                                                                                                                                                                                                                                                                                                                                                                          Function 0012D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000C3A97,?,?,000C2E7F,?,?,?,00000000), ref: 000C3AC2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012E199: GetFileAttributesW.KERNEL32(?,0012CF95), ref: 0012E19A
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 0012D420
                                                                                                                                                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,?,?), ref: 0012D470
                                                                                                                                                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0012D481
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0012D498
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0012D4A1
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                                                                                                                                                                                                                                                                                                                          • String ID: \*.*
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2649000838-1173974218
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 668091ce3aeec634f25fcda9c63b3eb8dfb89ee54bce9c45097bc45a7a41cdb7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ca41c5c4da0b3f02345ba387cd78b02c9f1eee507c027a6e337c0c728e175678
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 668091ce3aeec634f25fcda9c63b3eb8dfb89ee54bce9c45097bc45a7a41cdb7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41316F310083959FC204EF64E855DEF77A8AF96314F444A1DF4D153192EB30AA19CB63
                                                                                                                                                                                                                                                                                                                                                                          Function 000FE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: __floor_pentium4
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4168288129-2761157908
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 34d9f2d45f9533c6b358f12e7917ce322b9070a1e395aa0335b0c3b43628a890
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: facc1f046acf5843595898a69fe43feaab5f4c898d87d0ecd95efaec6ec0be1b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 34d9f2d45f9533c6b358f12e7917ce322b9070a1e395aa0335b0c3b43628a890
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4C25872E086298FDB64CE28DD407FAB7B5EB44304F1441EADA0DE7651E778AE819F40
                                                                                                                                                                                                                                                                                                                                                                          Function 0013648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001364DC
                                                                                                                                                                                                                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 00136639
                                                                                                                                                                                                                                                                                                                                                                          • CoCreateInstance.OLE32(0015FCF8,00000000,00000001,0015FB68,?), ref: 00136650
                                                                                                                                                                                                                                                                                                                                                                          • CoUninitialize.OLE32 ref: 001368D4
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: .lnk
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 886957087-24824748
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 801bd954eea960ea59f4d5cbb0c3c454e8fa1be0778ddd3a915dce8fddca16ca
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ce5be1620e316509957a47a630d095e63d83f84d983e290b7717e0c6659eb2b3
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 801bd954eea960ea59f4d5cbb0c3c454e8fa1be0778ddd3a915dce8fddca16ca
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2BD12A71508301AFD314EF24C881EABB7E8EF99704F50896DF5558B292DB71E906CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 001422DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32(?,?,00000000), ref: 001422E8
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0013E4EC: GetWindowRect.USER32(?,?), ref: 0013E504
                                                                                                                                                                                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00142312
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 00142319
                                                                                                                                                                                                                                                                                                                                                                          • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00142355
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00142381
                                                                                                                                                                                                                                                                                                                                                                          • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 001423DF
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2387181109-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8bcbea19aaf3aa5cd6231f3c552353996514b9c512a5bc241ea563266d5c2cf2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 34249d109f7c249f7585bf60807f20b4b3efabb2c542f6a6f981bb03cbf00d97
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8bcbea19aaf3aa5cd6231f3c552353996514b9c512a5bc241ea563266d5c2cf2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B131DE72504315AFCB20DF54D849B9BBBE9FF88314F400A19F9859B191DB74EA88CBD2
                                                                                                                                                                                                                                                                                                                                                                          Function 00139B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00139B78
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00139C8B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00133874: GetInputState.USER32 ref: 001338CB
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00133874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00133966
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00139BA8
                                                                                                                                                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00139C75
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1972594611-438819550
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d8d452bc164fc491316ca2a956d7f5e1a1787628be7a92dc82682d5639fb22f9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 84e00c77be1a4f644101be8d447ee1ff954f64f310b71f49594754ac97c27627
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d8d452bc164fc491316ca2a956d7f5e1a1787628be7a92dc82682d5639fb22f9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F41407190420A9FDF15DFA4C989EEEBBB8EF05311F244159E815A7191EB709E84CFA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000D997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          • DefDlgProcW.USER32(?,?,?,?,?), ref: 000D9A4E
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 000D9B23
                                                                                                                                                                                                                                                                                                                                                                          • SetBkColor.GDI32(?,00000000), ref: 000D9B36
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Color$LongProcWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3131106179-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 48c011ad5ecc2b97f36ea975d01babe8c9866c361953640fca2d578ea7dfac06
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c3ab8990297ea0961d8dc42fe186d89394f93761fe7e66a009944c2a2610ac99
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 48c011ad5ecc2b97f36ea975d01babe8c9866c361953640fca2d578ea7dfac06
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E9A1F771208604FEE739AA2C8C59DBF36ADDB42350F15021BF512DABD1DB259D81D2B3
                                                                                                                                                                                                                                                                                                                                                                          Function 00141806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0014307A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014304E: _wcslen.LIBCMT ref: 0014309B
                                                                                                                                                                                                                                                                                                                                                                          • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0014185D
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 00141884
                                                                                                                                                                                                                                                                                                                                                                          • bind.WSOCK32(00000000,?,00000010), ref: 001418DB
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 001418E6
                                                                                                                                                                                                                                                                                                                                                                          • closesocket.WSOCK32(00000000), ref: 00141915
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1601658205-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b3b8ac8a21a4c504985d2bc7be117bcd5ae13ecacc425704f2a2659970d230e6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d743a702904d5f1eac80f92ddf855cca5d642b8fb4d5128690956551c9e690f7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3b8ac8a21a4c504985d2bc7be117bcd5ae13ecacc425704f2a2659970d230e6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB518275A00210AFEB10AF24C886F6E77E5AF44718F58845CF91A5F3D3D771AD828BA1
                                                                                                                                                                                                                                                                                                                                                                          Function 00151C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 292994002-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: ed64852021daafa74163d00628eb550e04c49d59935fe7e2d458403797f96599
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7eaf7446c71c640527b3a4b6254985b7820eff138de8e003c54c855acc3a8c2c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ed64852021daafa74163d00628eb550e04c49d59935fe7e2d458403797f96599
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59219131740211EFD7228F1AC884F6A7BA5AF95326B59806CEC5A8F351D772EC46CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 000C8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 0-1546025612
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0ac5fca57935855bef588b8e1e422e2c109edec0d239854d71dd5114d4a01200
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: bcb9f5da3d53189d31ad1bfc75a8ed28ccc248fb836e8312290ebb979463bdca
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ac5fca57935855bef588b8e1e422e2c109edec0d239854d71dd5114d4a01200
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E6A28470E0061ACBDF34CF58C944BAEB7B2BF54310F2481AAE855A7285EBB49D91CF54
                                                                                                                                                                                                                                                                                                                                                                          Function 0013CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • InternetReadFile.WININET(?,?,00000400,?), ref: 0013CE89
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00000000), ref: 0013CEEA
                                                                                                                                                                                                                                                                                                                                                                          • SetEvent.KERNEL32(?,?,00000000), ref: 0013CEFE
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorEventFileInternetLastRead
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 234945975-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9f5d1874e3ce7b65695395cc492a0232441eb43523e312183c6b285455f70680
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c6be232bac8370517148c79276cf7bdb498aca5f1b8d4203b6c2f6c7288562ea
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f5d1874e3ce7b65695395cc492a0232441eb43523e312183c6b285455f70680
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A21BAB1500705EFEB20DFA5C948BAABBFCEB40358F10442EE646A6151E770EE448BA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00128298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?,?,?,00000000), ref: 001282AA
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: lstrlen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ($|
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1659193697-1631851259
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7a963c470f39a80aa147386761d43a9d922651d154119a165a57d5106070cb31
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: de142dacf061b0bcea1a70d23d5400b6179f202124812df7364798c8645f5f2e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7a963c470f39a80aa147386761d43a9d922651d154119a165a57d5106070cb31
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 78323474A007159FCB28CF19D481AAAB7F0FF48710B15C46EE49ADB3A1EB70E991CB50
                                                                                                                                                                                                                                                                                                                                                                          Function 00135C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00135CC1
                                                                                                                                                                                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00135D17
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(?), ref: 00135D5F
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Find$File$CloseFirstNext
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3541575487-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a32036613fe2f5f696f5f3f6177c6321a4486539b5d6a29ba1f7fc0a69a43f92
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d6588f328656fa5a9ff5216632ccc0ed825dc2bc19ce010cfd1c18eca090a039
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a32036613fe2f5f696f5f3f6177c6321a4486539b5d6a29ba1f7fc0a69a43f92
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 19518874604B019FC718CF68C494E9AB7E5FF49324F14855EE99A8B3A2CB30ED45CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 000F2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • IsDebuggerPresent.KERNEL32 ref: 000F271A
                                                                                                                                                                                                                                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000F2724
                                                                                                                                                                                                                                                                                                                                                                          • UnhandledExceptionFilter.KERNEL32(?), ref: 000F2731
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3906539128-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 2ed8c6f8099ee39833d07d86007028c6d7428354f2c686701a00e6e74d1fa1a6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 503d0e49cdbd4f5d9859389cdbedd17b651b57b5171377a6f43db7bef4a3651d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2ed8c6f8099ee39833d07d86007028c6d7428354f2c686701a00e6e74d1fa1a6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F31B47491131CDBCB61EF65DC897D9B7B8AF18310F5041EAE41CA6261E7709F818F45
                                                                                                                                                                                                                                                                                                                                                                          Function 001351CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 001351DA
                                                                                                                                                                                                                                                                                                                                                                          • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00135238
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000000), ref: 001352A1
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorMode$DiskFreeSpace
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1682464887-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a8780a57debadbba4af31378951155e5a176dba3d900d20c5deed2668e0a30b7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: da583d01b93b81c1d22b092f28e4ab961b2920ed3efca2804f5f2d6a22019db5
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a8780a57debadbba4af31378951155e5a176dba3d900d20c5deed2668e0a30b7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B6312F75A00618DFDB00DF54D884FAEBBB5FF49314F448099E8099B352DB71E856CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 001216C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 000E0668
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 000E0685
                                                                                                                                                                                                                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0012170D
                                                                                                                                                                                                                                                                                                                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0012173A
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0012174A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 577356006-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e744e74b74c45d0513578d013ed8d8a56c0390c08c7516beef962c3ccd9d2c93
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: dd6456e5fb9edd36784c2567934c126a314c7690a2b819000fe6adbe30d57025
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e744e74b74c45d0513578d013ed8d8a56c0390c08c7516beef962c3ccd9d2c93
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4F1191B2404305BFD718DF54EC86DABB7BAEB44725B20852EF05657641EB70BC51CA60
                                                                                                                                                                                                                                                                                                                                                                          Function 0012D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0012D608
                                                                                                                                                                                                                                                                                                                                                                          • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0012D645
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0012D650
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 33631002-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: dc30ee7cee2f6e1cc73734792fcc4bf832d1de54d8b1fc552a12676bb6fb3753
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 175c35e730bdfe0af6229cc78e2c436d0b275f9c6f266c8003388e706aa71db5
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc30ee7cee2f6e1cc73734792fcc4bf832d1de54d8b1fc552a12676bb6fb3753
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4112A75A05328BFDB108F95EC45BAFBBBCEB45B50F108115F914A7290D6704A058BE1
                                                                                                                                                                                                                                                                                                                                                                          Function 00121663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0012168C
                                                                                                                                                                                                                                                                                                                                                                          • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 001216A1
                                                                                                                                                                                                                                                                                                                                                                          • FreeSid.ADVAPI32(?), ref: 001216B1
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3429775523-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 76124bd3b3aa1ffe34d436ba771debc7ec2139a71cf29ea34f3be660b1919f2e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9755391efd243871cd512cf0776f58ce490adcc57a80c436b7057bc31fb146d8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 76124bd3b3aa1ffe34d436ba771debc7ec2139a71cf29ea34f3be660b1919f2e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F1F0F475950309FFDB00DFE49C89AAEBBBCFB08605F504565E501E6181E774AA848A90
                                                                                                                                                                                                                                                                                                                                                                          Function 000E4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(000F28E9,?,000E4CBE,000F28E9,001888B8,0000000C,000E4E15,000F28E9,00000002,00000000,?,000F28E9), ref: 000E4D09
                                                                                                                                                                                                                                                                                                                                                                          • TerminateProcess.KERNEL32(00000000,?,000E4CBE,000F28E9,001888B8,0000000C,000E4E15,000F28E9,00000002,00000000,?,000F28E9), ref: 000E4D10
                                                                                                                                                                                                                                                                                                                                                                          • ExitProcess.KERNEL32 ref: 000E4D22
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1703294689-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 66f8686cbf4736b9a9c41be0c083c6917ea6fb9b471e8d7654a85c7517337271
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7de24a0c3dc984b89390039695ef4fcf811715bcdd8066b4b8912559b1620468
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 66f8686cbf4736b9a9c41be0c083c6917ea6fb9b471e8d7654a85c7517337271
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B2E0B631005788EFCF51AF55DD09A983F69FF81792B108054FD05DA623CB35DD82DA80
                                                                                                                                                                                                                                                                                                                                                                          Function 000FC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID: /
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 0-2043925204
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 802ca95a89219b985e151c83d86cb958af4139782ae3e3e79329b41b65edd8dc
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 692e0714861022b332f7e76f77586b75620ec189908a145ad9b7799e53fc9a7a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 802ca95a89219b985e151c83d86cb958af4139782ae3e3e79329b41b65edd8dc
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3B415B7290021DAFDB209FB9CD4ADBB77B8EBC4354F104269FA05D7581E6709E80DB50
                                                                                                                                                                                                                                                                                                                                                                          Function 0011D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetUserNameW.ADVAPI32(?,?), ref: 0011D28C
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: NameUser
                                                                                                                                                                                                                                                                                                                                                                          • String ID: X64
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2645101109-893830106
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b3f74d578713cff5cf66f419bd28fa7afd30c0439f0c257ef254a4031173e3f2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 10607fe7b41f377026fca243f8ce891669d7aba2b04a70328e63fd852b3f4a07
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3f74d578713cff5cf66f419bd28fa7afd30c0439f0c257ef254a4031173e3f2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AFD0C9B480121DEECF94CB90EC88DDDB7BCBB04305F100152F106A2140D77495888F20
                                                                                                                                                                                                                                                                                                                                                                          Function 000ECAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d18c819ce543c4553193f1225d589858fb06fe27032c3b3b226e889b80d46367
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 48020D71E012599FEF14CFA9C880AADFBF1EF48314F25416AD919F7384D731A9428B94
                                                                                                                                                                                                                                                                                                                                                                          Function 001368EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00136918
                                                                                                                                                                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00136961
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: f30a49bae1391b7428c09ebe100717a7bcd02561846f0dc9fa7134befb3349fd
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 703e1f863f072150b11493b37a1c503e39af75cc562169807cc7e8405bd257ce
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f30a49bae1391b7428c09ebe100717a7bcd02561846f0dc9fa7134befb3349fd
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 02117C31604600AFD710DF29D484F1ABBE5EF85329F15C6ADE4699F6A2C730EC46CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 001337B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00144891,?,?,00000035,?), ref: 001337E4
                                                                                                                                                                                                                                                                                                                                                                          • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00144891,?,?,00000035,?), ref: 001337F4
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorFormatLastMessage
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3479602957-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 33706c063f0ec429bed9d9da7adf4fb2aaac7fc2035214f4b8ead52e42825a9d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: bdd302aa19936d476591579ccafcd3cbe5b466602637b4926f352a6ce12977cd
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 33706c063f0ec429bed9d9da7adf4fb2aaac7fc2035214f4b8ead52e42825a9d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13F0E5B06043296AE72017668C4DFEB3AAEEFC4761F000165F519D2691DA609944C7F0
                                                                                                                                                                                                                                                                                                                                                                          Function 0012B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0012B25D
                                                                                                                                                                                                                                                                                                                                                                          • keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 0012B270
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: InputSendkeybd_event
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3536248340-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6c1696db836a9d3458c763f15b59b799c60b0132ef55df125931a3a6008623c0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4c2b865533df043d283452ff297b6f8029bb191b6ab6b04389a22c32e88b160b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6c1696db836a9d3458c763f15b59b799c60b0132ef55df125931a3a6008623c0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 87F01D7190438EEFDB059FA0D805BAE7FB4FF08305F008009F965A9192D3799651DF94
                                                                                                                                                                                                                                                                                                                                                                          Function 001210BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,001211FC), ref: 001210D4
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,001211FC), ref: 001210E9
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AdjustCloseHandlePrivilegesToken
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 81990902-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e7e22e9cae28f10b9b01aebd5aef422d429f52c7b722e6cb210f963a4b16263e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: dceaa8d01bf5b5fc6d5ed2aa3b99623eb69282d3441e4142f1ed522b2b7e2c56
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e7e22e9cae28f10b9b01aebd5aef422d429f52c7b722e6cb210f963a4b16263e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 64E04F32004711EEE7252B51FC05EB377A9EB04311B10C82EF4A6844B2DB626CE0DB60
                                                                                                                                                                                                                                                                                                                                                                          Function 000CCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          • Variable is not of type 'Object'., xrefs: 00110C40
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Variable is not of type 'Object'.
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 0-1840281001
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9470543efa240a50d9e3a8acdd808dc783e95ba970595730baaf24c747104324
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9979707c0b50a7abf1641d50c85473d600861e4d040bd5c92c532e790d046c47
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9470543efa240a50d9e3a8acdd808dc783e95ba970595730baaf24c747104324
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 66327E74900218DBEF18DF94D881FEDB7B5BF09304F14406DE80AAB292D775AE86CB61
                                                                                                                                                                                                                                                                                                                                                                          Function 000F676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,000F6766,?,?,00000008,?,?,000FFEFE,00000000), ref: 000F6998
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ExceptionRaise
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3997070919-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 3d38beff9b730ad736290ed9ddfe32c8526d361d6fc7438ce93ee7d1cde36725
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 895153ecf58358ce0267c247208f493558a8d0cf2063f83394a9e3ce3737edc8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3d38beff9b730ad736290ed9ddfe32c8526d361d6fc7438ce93ee7d1cde36725
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BEB16C31610608DFD755CF28C486B647BE0FF45364F29865CE99ACF6A2C736E982DB40
                                                                                                                                                                                                                                                                                                                                                                          Function 000DB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 0-3916222277
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 2df3c592bf445074fe3cd051023d91f9f603b7fd656f093ed65bd13792bc200a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e4f8145430d1d2876609337952a3140a967ae97fae00ba0bd1c44ae1e3f2fbc7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2df3c592bf445074fe3cd051023d91f9f603b7fd656f093ed65bd13792bc200a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7124175900229DBDB64CF58C881AEEB7F5FF48710F15816AE849EB255DB309E81CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0013EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • BlockInput.USER32(00000001), ref: 0013EABD
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: BlockInput
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3456056419-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b6061960566172e262e5adcca9175863928d346bfde5d985963917e142937582
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 1dd19c41904bc87e2d50f6432a8098db728ad200409080f89841ac4314d389d7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b6061960566172e262e5adcca9175863928d346bfde5d985963917e142937582
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B2E04F312003059FD710EF59D805E9AF7E9AF98760F00842AFC49CB391DB70E8418B90
                                                                                                                                                                                                                                                                                                                                                                          Function 000E09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,000E03EE), ref: 000E09DA
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3192549508-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 03391f66fb04785be65405be740459772f58e877bccce36d50f0432b68ca1e3a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: dcf4ef48895afd9597ad5215be1ea7a8f1ab6bdb81cc765ab5c9fb2bc9d243ec
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 03391f66fb04785be65405be740459772f58e877bccce36d50f0432b68ca1e3a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                                                                                                                                                          Function 000E781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 0-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 09da0e2873799e4f8b458868389a39aa8fd1336a06e8cfb83cf2f498919d77fb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2451977168C6C55FDBB8856B8A597FE23C99F62300F18051AD98EF7283CE11DE01D352
                                                                                                                                                                                                                                                                                                                                                                          Function 000F6DD9 Relevance: .6, Instructions: 637COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: ed164f075aef45cbf62344498d9acb0b56fd6f53942877fa71c08462a0db5d79
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 83e1b719a77c3f9e1b37c8abd5cf33fa2eed58322d96203af69dad9430a4ed7f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ed164f075aef45cbf62344498d9acb0b56fd6f53942877fa71c08462a0db5d79
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2323222D29F054DD7639634CC22336A289AFB73C5F15C737E81AB5EAAEB69C4C35101
                                                                                                                                                                                                                                                                                                                                                                          Function 000DCC39 Relevance: .6, Instructions: 635COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a1daeb65b9b887988e0d5492a9fe2890e00cdc49ec5d53346e7f0deafe4ef91a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9ec4cc2e1abdf30387b77ddf22867a9f6e50c9886598dcb02bb9aeeaa7b6b11a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a1daeb65b9b887988e0d5492a9fe2890e00cdc49ec5d53346e7f0deafe4ef91a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B5320131A842168BDF2CCA28C594AFD7BA1AF45300F29817BD95A8B791E330DDC1DBD1
                                                                                                                                                                                                                                                                                                                                                                          Function 000C7920 Relevance: .6, Instructions: 563COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c38820a30aa65c4331af366236effe4ecc4603f7a95e7c534fba961a5c1ebc25
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3c31fdb879a3ca499b5864be6133bd625d96bae0837d560d6aa964c72ef2455d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c38820a30aa65c4331af366236effe4ecc4603f7a95e7c534fba961a5c1ebc25
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41227D70A0460A9FDF14CFA4C881BEEB7B6FF44300F144529E856AB291EB76AE55CF50
                                                                                                                                                                                                                                                                                                                                                                          Function 000C91C0 Relevance: .5, Instructions: 475COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 045cd920c9504e5a57f0d710fa78d6b977c71517a9bb5158e77dafcd33b06fc5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 527bba27562e6b7fee4cf4fab65104abc428ae5ca697ed64da699e87014f551e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 045cd920c9504e5a57f0d710fa78d6b977c71517a9bb5158e77dafcd33b06fc5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0E02C5B0A0020AEBDB04DF55D981BAEB7F5FF44300F118569E8569B3D1EB71EA60CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 000F9EEE Relevance: .3, Instructions: 294COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 30ca1fd8d81b0cba7fb012033828080419b2c722fd7c69da08ce72450fbada8e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 433662b67baf602453a4bd049faa5d086f73dbfdd06aff0391860febcfbb5e02
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 30ca1fd8d81b0cba7fb012033828080419b2c722fd7c69da08ce72450fbada8e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 85B1D020E2AF414DD22396398C75336B65CBFBB6D5B91D71BFC2A74E62EB2186C34140
                                                                                                                                                                                                                                                                                                                                                                          Function 000E1C77 Relevance: .3, Instructions: 254COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 83586e4f31aa9770d4b25d885616c28e0874cee028d1af9f8970685c8eb0108f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7091757260D0E34EDB69463B85744BEFFE15F923A131A079EE4F2EA1C1EE348954D620
                                                                                                                                                                                                                                                                                                                                                                          Function 000E1F32 Relevance: .2, Instructions: 244COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 037939f9f7862a6f396234533332b665b873ce0395ad2e1b55692462f9fde572
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A79178722090E34DDBAD423B857407EFFE55B923A131A07ADD4F2EB1D6EE24CA54D620
                                                                                                                                                                                                                                                                                                                                                                          Function 000E19B0 Relevance: .2, Instructions: 240COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 930e137f5fe05022a88224b11b57d7163c88818408e11b138ed99675d706f060
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A9110722090E34EDBA9467B85740BEFFE15B923A131E07AED4F2EA1C1FE348554D620
                                                                                                                                                                                                                                                                                                                                                                          Function 000E7A4A Relevance: .2, Instructions: 237COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 2a4ed5df518b71ff1141161c4ca5776b39a58ea48c0641888a82d93f6dd532c0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 43e36337a6b00c3a361aec025f8c72ffa79d6bd9efd61115ee6c8d4604ec960c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2a4ed5df518b71ff1141161c4ca5776b39a58ea48c0641888a82d93f6dd532c0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F5616A716087C99EDAB4992B4855BFF33D8DF81700F28492DE94EFB282D7119E42C316
                                                                                                                                                                                                                                                                                                                                                                          Function 000E7CA7 Relevance: .2, Instructions: 237COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a3676d619fea96b7672b781962a8bd76f7ee755a8a224e947ea0908db589811d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0175598e64e41a756dca68d92176390ebbe10a6eced97735d38570edcbc48924
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a3676d619fea96b7672b781962a8bd76f7ee755a8a224e947ea0908db589811d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E61897120C7C96EDAB84A2B4C91BFE23E9DF46700F10495AE84FFB382DA129D428311
                                                                                                                                                                                                                                                                                                                                                                          Function 000E1706 Relevance: .2, Instructions: 232COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 851cbf7890a22c5ec2f426a73c8a012cebcbc9b46d1f71a18e656659bbd6678b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 888150726090E34EDBAD423B85744BEFFE15B923A131A079ED4F2DA1C2EE348554E620
                                                                                                                                                                                                                                                                                                                                                                          Function 00132046 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5ee4ba6130d4f83a450e2360fc425a827998d09906dc4116e31f1cd4938c05e9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6a96f9a6200a82dd70e9322c4ec9f8a680acdde617eb360df9d1431bad13ed2b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ee4ba6130d4f83a450e2360fc425a827998d09906dc4116e31f1cd4938c05e9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9E21E7322216118BDB2CCF79C8236BE73E5A754320F14862EE4A7C37D0DE39A944CB80
                                                                                                                                                                                                                                                                                                                                                                          Function 00142ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00142B30
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00142B43
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32 ref: 00142B52
                                                                                                                                                                                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00142B6D
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 00142B74
                                                                                                                                                                                                                                                                                                                                                                          • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00142CA3
                                                                                                                                                                                                                                                                                                                                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00142CB1
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142CF8
                                                                                                                                                                                                                                                                                                                                                                          • GetClientRect.USER32(00000000,?), ref: 00142D04
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00142D40
                                                                                                                                                                                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D62
                                                                                                                                                                                                                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D75
                                                                                                                                                                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D80
                                                                                                                                                                                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00142D89
                                                                                                                                                                                                                                                                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142D98
                                                                                                                                                                                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00142DA1
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142DA8
                                                                                                                                                                                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00142DB3
                                                                                                                                                                                                                                                                                                                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142DC5
                                                                                                                                                                                                                                                                                                                                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,0015FC38,00000000), ref: 00142DDB
                                                                                                                                                                                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00142DEB
                                                                                                                                                                                                                                                                                                                                                                          • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00142E11
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00142E30
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00142E52
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0014303F
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                                                                                                                                                                                                                                                                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2211948467-2373415609
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7363406f8dcebc8360c5071a2104ff5fb8dcd94dc4e7ec7224bdaa4fea7c5db3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4de34e1fb412a2601c910401f35bf77e640deb5981bd2cc4c83d74c21d60fe5b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7363406f8dcebc8360c5071a2104ff5fb8dcd94dc4e7ec7224bdaa4fea7c5db3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 52025A71900205EFDB14DF64CC89EAE7BB9FB48711F048158F915AB2A1CB70AE81CFA0
                                                                                                                                                                                                                                                                                                                                                                          Function 001570D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetTextColor.GDI32(?,00000000), ref: 0015712F
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00157160
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 0015716C
                                                                                                                                                                                                                                                                                                                                                                          • SetBkColor.GDI32(?,000000FF), ref: 00157186
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00157195
                                                                                                                                                                                                                                                                                                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 001571C0
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(00000010), ref: 001571C8
                                                                                                                                                                                                                                                                                                                                                                          • CreateSolidBrush.GDI32(00000000), ref: 001571CF
                                                                                                                                                                                                                                                                                                                                                                          • FrameRect.USER32(?,?,00000000), ref: 001571DE
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 001571E5
                                                                                                                                                                                                                                                                                                                                                                          • InflateRect.USER32(?,000000FE,000000FE), ref: 00157230
                                                                                                                                                                                                                                                                                                                                                                          • FillRect.USER32(?,?,?), ref: 00157262
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00157284
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: GetSysColor.USER32(00000012), ref: 00157421
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: SetTextColor.GDI32(?,?), ref: 00157425
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: GetSysColorBrush.USER32(0000000F), ref: 0015743B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: GetSysColor.USER32(0000000F), ref: 00157446
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: GetSysColor.USER32(00000011), ref: 00157463
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00157471
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: SelectObject.GDI32(?,00000000), ref: 00157482
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: SetBkColor.GDI32(?,00000000), ref: 0015748B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: SelectObject.GDI32(?,?), ref: 00157498
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: InflateRect.USER32(?,000000FF,000000FF), ref: 001574B7
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001574CE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001573E8: GetWindowLongW.USER32(00000000,000000F0), ref: 001574DB
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4124339563-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9e6973547668093934762089f8076a4d63df1e3b44b49c36958913eef74696e5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 02c6def1ba9cedb79cbe5dbbef64dfce3deb2ab31fdc2b09f191e32d9507cd87
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e6973547668093934762089f8076a4d63df1e3b44b49c36958913eef74696e5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F1A1A572108701FFD7019F60DC49E5BBBAAFF89322F100A19F9629A5E1D771E984CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 000D8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(?,?), ref: 000D8E14
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 00116AC5
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00116AFE
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00116F43
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,000D8BE8,?,00000000,?,?,?,?,000D8BBA,00000000,?), ref: 000D8FC5
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001053), ref: 00116F7F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00116F96
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(00000000,?), ref: 00116FAC
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(00000000,?), ref: 00116FB7
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2760611726-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 08baadfc898c45e0640acd6cb7c42f2ac840e1681ffea36970423f2431de854f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b8aa2e3e0aeb097bd7c1089dd375ae34cdd0dc0c80e05c1aedd0b743d68694cf
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 08baadfc898c45e0640acd6cb7c42f2ac840e1681ffea36970423f2431de854f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B128C30205312EFDB29CF14D858BEAB7E5FB44305F14856AF4858B661CB32A8D2DFA1
                                                                                                                                                                                                                                                                                                                                                                          Function 00142711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(00000000), ref: 0014273E
                                                                                                                                                                                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0014286A
                                                                                                                                                                                                                                                                                                                                                                          • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 001428A9
                                                                                                                                                                                                                                                                                                                                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 001428B9
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00142900
                                                                                                                                                                                                                                                                                                                                                                          • GetClientRect.USER32(00000000,?), ref: 0014290C
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00142955
                                                                                                                                                                                                                                                                                                                                                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00142964
                                                                                                                                                                                                                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 00142974
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 00142978
                                                                                                                                                                                                                                                                                                                                                                          • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00142988
                                                                                                                                                                                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00142991
                                                                                                                                                                                                                                                                                                                                                                          • DeleteDC.GDI32(00000000), ref: 0014299A
                                                                                                                                                                                                                                                                                                                                                                          • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 001429C6
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000030,00000000,00000001), ref: 001429DD
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00142A1D
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00142A31
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000404,00000001,00000000), ref: 00142A42
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00142A77
                                                                                                                                                                                                                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 00142A82
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00142A8D
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00142A97
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                                                                                                                                                                                                                                                                                                                          • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2910397461-517079104
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e1eb5a711548eb622f23fb6431964f457ef3011db29f117bf7ca2ec293040e3b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 19d972074b38e38aa07cca1a40d5eff3890e5c26af8a50782d8d77fb41b9c231
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e1eb5a711548eb622f23fb6431964f457ef3011db29f117bf7ca2ec293040e3b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9B13C71A00615AFEB14DF68CC86FAE7BB9FB08711F004519F915EB6A1D774AD80CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00134ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 00134AED
                                                                                                                                                                                                                                                                                                                                                                          • GetDriveTypeW.KERNEL32(?,0015CB68,?,\\.\,0015CC08), ref: 00134BCA
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000000,0015CB68,?,\\.\,0015CC08), ref: 00134D36
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorMode$DriveType
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2907320926-4222207086
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: f2ae40cf978348a82ca8b9e4afe7fc11772b5c6b51370979863527363edec4db
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 998e03fb4a306c50beadfce79322d0515ef682594c7de93f43e773dff12036af
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f2ae40cf978348a82ca8b9e4afe7fc11772b5c6b51370979863527363edec4db
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D661B030605205DFCB08EF64CA82EADB7A0EB04340F249519F846AB692DB76FE45DF81
                                                                                                                                                                                                                                                                                                                                                                          Function 001573E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(00000012), ref: 00157421
                                                                                                                                                                                                                                                                                                                                                                          • SetTextColor.GDI32(?,?), ref: 00157425
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 0015743B
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 00157446
                                                                                                                                                                                                                                                                                                                                                                          • CreateSolidBrush.GDI32(?), ref: 0015744B
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(00000011), ref: 00157463
                                                                                                                                                                                                                                                                                                                                                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00157471
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 00157482
                                                                                                                                                                                                                                                                                                                                                                          • SetBkColor.GDI32(?,00000000), ref: 0015748B
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00157498
                                                                                                                                                                                                                                                                                                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 001574B7
                                                                                                                                                                                                                                                                                                                                                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001574CE
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 001574DB
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0015752A
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00157554
                                                                                                                                                                                                                                                                                                                                                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 00157572
                                                                                                                                                                                                                                                                                                                                                                          • DrawFocusRect.USER32(?,?), ref: 0015757D
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(00000011), ref: 0015758E
                                                                                                                                                                                                                                                                                                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00157596
                                                                                                                                                                                                                                                                                                                                                                          • DrawTextW.USER32(?,001570F5,000000FF,?,00000000), ref: 001575A8
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 001575BF
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 001575CA
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 001575D0
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 001575D5
                                                                                                                                                                                                                                                                                                                                                                          • SetTextColor.GDI32(?,?), ref: 001575DB
                                                                                                                                                                                                                                                                                                                                                                          • SetBkColor.GDI32(?,?), ref: 001575E5
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1996641542-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9ddfda532521aefb20c3f41432a2579e8542159e54056f26d2377d451eac973c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 25e42a27f3b71664d526bb835423b42d41127c5a032021fce651c8bedc5e7b25
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9ddfda532521aefb20c3f41432a2579e8542159e54056f26d2377d451eac973c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13613B72904318EFDB019FA4EC49AEEBFB9EB08322F114115F915AB2E1D7759980CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00150FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00151128
                                                                                                                                                                                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 0015113D
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 00151144
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00151199
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 001511B9
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 001511ED
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0015120B
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0015121D
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000421,?,?), ref: 00151232
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00151245
                                                                                                                                                                                                                                                                                                                                                                          • IsWindowVisible.USER32(00000000), ref: 001512A1
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 001512BC
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 001512D0
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 001512E8
                                                                                                                                                                                                                                                                                                                                                                          • MonitorFromPoint.USER32(?,?,00000002), ref: 0015130E
                                                                                                                                                                                                                                                                                                                                                                          • GetMonitorInfoW.USER32(00000000,?), ref: 00151328
                                                                                                                                                                                                                                                                                                                                                                          • CopyRect.USER32(?,?), ref: 0015133F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000412,00000000), ref: 001513AA
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ($0$tooltips_class32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 698492251-4156429822
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 81e81707e42c2c5c192aa5265c2fc888cdb9e0bb677eb29d19ed63df39699e03
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e569b84d83ba31c074701402a7c62c3421f1caa326d5d55af9177731a0552f2a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 81e81707e42c2c5c192aa5265c2fc888cdb9e0bb677eb29d19ed63df39699e03
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22B15771604341EFD705DF64C885BAABBE4FF88351F00891CF9A99B2A2D771E849CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 00150241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,?), ref: 001502E5
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0015031F
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00150389
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001503F1
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00150475
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 001504C5
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00150504
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DF9F2: _wcslen.LIBCMT ref: 000DF9FD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00122258
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0012228A
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                                                                                                                                                                                                                                                                                                                          • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1103490817-719923060
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 947efd535be31f880c613a88cba985d0f7d0fff22bd670fcd4f70d7e71f90306
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 86faf56df8482f9db5729510d1396a03423cff82021908b26d9a4039e94887e0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 947efd535be31f880c613a88cba985d0f7d0fff22bd670fcd4f70d7e71f90306
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60E19C31208301CFC715EF64C55196EB3E6BF98315B54496DF8A6AB3A2DB30EE49CB81
                                                                                                                                                                                                                                                                                                                                                                          Function 000D8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000D8968
                                                                                                                                                                                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000007), ref: 000D8970
                                                                                                                                                                                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000D899B
                                                                                                                                                                                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000008), ref: 000D89A3
                                                                                                                                                                                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000004), ref: 000D89C8
                                                                                                                                                                                                                                                                                                                                                                          • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 000D89E5
                                                                                                                                                                                                                                                                                                                                                                          • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 000D89F5
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 000D8A28
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 000D8A3C
                                                                                                                                                                                                                                                                                                                                                                          • GetClientRect.USER32(00000000,000000FF), ref: 000D8A5A
                                                                                                                                                                                                                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 000D8A76
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 000D8A81
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D912D: GetCursorPos.USER32(?), ref: 000D9141
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D912D: ScreenToClient.USER32(00000000,?), ref: 000D915E
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D912D: GetAsyncKeyState.USER32(00000001), ref: 000D9183
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D912D: GetAsyncKeyState.USER32(00000002), ref: 000D919D
                                                                                                                                                                                                                                                                                                                                                                          • SetTimer.USER32(00000000,00000000,00000028,000D90FC), ref: 000D8AA8
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                                                                                                                                                                                                                                                                                                                          • String ID: AutoIt v3 GUI
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1458621304-248962490
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 42d968cbe284ed608ab825a7b2956996f2686ef297158e8ae9ca6f4e0771058d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 645244f3f7e8e79d5ac68d25678058ebd5b2a51b972d79b111b419c0005ef56b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 42d968cbe284ed608ab825a7b2956996f2686ef297158e8ae9ca6f4e0771058d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2B16F75A0030AEFDB14DFA8CC55BEE7BB5FB48315F10412AFA15AB290DB70A981CB51
                                                                                                                                                                                                                                                                                                                                                                          Function 00120D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00121114
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121120
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 0012112F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121136
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0012114D
                                                                                                                                                                                                                                                                                                                                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00120DF5
                                                                                                                                                                                                                                                                                                                                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00120E29
                                                                                                                                                                                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?), ref: 00120E40
                                                                                                                                                                                                                                                                                                                                                                          • GetAce.ADVAPI32(?,00000000,?), ref: 00120E7A
                                                                                                                                                                                                                                                                                                                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00120E96
                                                                                                                                                                                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?), ref: 00120EAD
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00120EB5
                                                                                                                                                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(00000000), ref: 00120EBC
                                                                                                                                                                                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00120EDD
                                                                                                                                                                                                                                                                                                                                                                          • CopySid.ADVAPI32(00000000), ref: 00120EE4
                                                                                                                                                                                                                                                                                                                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00120F13
                                                                                                                                                                                                                                                                                                                                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00120F35
                                                                                                                                                                                                                                                                                                                                                                          • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00120F47
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120F6E
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 00120F75
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120F7E
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 00120F85
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00120F8E
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 00120F95
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 00120FA1
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 00120FA8
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121193: GetProcessHeap.KERNEL32(00000008,00120BB1,?,00000000,?,00120BB1,?), ref: 001211A1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00120BB1,?), ref: 001211A8
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00120BB1,?), ref: 001211B7
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4175595110-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: da880f43b62944f5c6a9a5d1690f618fa77749f5845f190df08a65cf3efe32e0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 19652e365b2a03c1d3318dc9a9e76091de2655cdd5446f682e5a368ccdf26ebf
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: da880f43b62944f5c6a9a5d1690f618fa77749f5845f190df08a65cf3efe32e0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3717D7290031AEFDF219FA4ED44BAEBBB8FF08311F044215F919A6192D7319955CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0014C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014C4BD
                                                                                                                                                                                                                                                                                                                                                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,0015CC08,00000000,?,00000000,?,?), ref: 0014C544
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0014C5A4
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0014C5F4
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0014C66F
                                                                                                                                                                                                                                                                                                                                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0014C6B2
                                                                                                                                                                                                                                                                                                                                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0014C7C1
                                                                                                                                                                                                                                                                                                                                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0014C84D
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 0014C881
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0014C88E
                                                                                                                                                                                                                                                                                                                                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0014C960
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                                                                                                                                                                                                                                                                                                                                          • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 9721498-966354055
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 79944e5ef9338cd3e967804c7c3494000be9424a9e85334c26619b36fc5d28ab
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e6687634511ce4ecaddcc61b7109a915ac0af0a325da96162150e83c2df140d9
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 79944e5ef9338cd3e967804c7c3494000be9424a9e85334c26619b36fc5d28ab
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C91224356046019FD754DF14C891F6EB7E5EF88724F15889CF88A9B2A2DB31ED41CB81
                                                                                                                                                                                                                                                                                                                                                                          Function 0015091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,?), ref: 001509C6
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00150A01
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00150A54
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00150A8A
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00150B06
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00150B81
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DF9F2: _wcslen.LIBCMT ref: 000DF9FD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00122BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00122BFA
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                                                                                                                                                                                                                                                                                                                          • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1103490817-4258414348
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0a12f698144fa67f0a4fe7570abbae9e7acd99ec8ab38528609ca9a10c5512ad
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2408238242c4c18d087d56b1da5a220560f726e0fbc177d3ac40108de0f904c8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a12f698144fa67f0a4fe7570abbae9e7acd99ec8ab38528609ca9a10c5512ad
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7E1DF35208301CFC715DFA4C49096EB7E1BF98314B15895CF8AAAB3A2D730EE49CB81
                                                                                                                                                                                                                                                                                                                                                                          Function 0014C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$BuffCharUpper
                                                                                                                                                                                                                                                                                                                                                                          • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1256254125-909552448
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6de378dadab809f07c84dade009ff97e38042545585b314a18bdfdd4d3237031
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ba71192b8de4c67bc6f792799368609e041d7518f69318802a0f1b4c6feaa0ae
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6de378dadab809f07c84dade009ff97e38042545585b314a18bdfdd4d3237031
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0671F33260116A8BCB60DF7CC9915FE3391AFA1794B350528F866A72A5FB31CE44C7E0
                                                                                                                                                                                                                                                                                                                                                                          Function 0015833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0015835A
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0015836E
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00158391
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001583B4
                                                                                                                                                                                                                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 001583F2
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00155BF2), ref: 0015844E
                                                                                                                                                                                                                                                                                                                                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00158487
                                                                                                                                                                                                                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 001584CA
                                                                                                                                                                                                                                                                                                                                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00158501
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0015850D
                                                                                                                                                                                                                                                                                                                                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0015851D
                                                                                                                                                                                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?,00155BF2), ref: 0015852C
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00158549
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00158555
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                                                                                                                                                                                                                                                                                                                                          • String ID: .dll$.exe$.icl
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 799131459-1154884017
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5ea143b0b7b2a1a90818490b03d3079eacb38f8f2ef5ac0ac1d9ae790ed22348
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7df2516ab6c7da0ac2d8d2d898f3f6545676ad3b5ec096f8992cb94430fc5223
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ea143b0b7b2a1a90818490b03d3079eacb38f8f2ef5ac0ac1d9ae790ed22348
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A2619E71510715FEEB149F64CC85BFE77A8BB08722F104509FD25EA1D1EBB4AA84CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000C7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 0-1645009161
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: ef3398f5b5cd4d27ac6553b4eeb25784512efcd170e8f2b582cdfdb28af5542a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 1e6e35bf46f4cc2f33a3c10eb107cdc4cc941da42b55dc8f86a87f3617b15e56
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ef3398f5b5cd4d27ac6553b4eeb25784512efcd170e8f2b582cdfdb28af5542a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6781C671644605BFDB20AF60DD42FEF37A9AF15300F044029F949AA2D7EBB0DA15DBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 00133E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CharLowerBuffW.USER32(?,?), ref: 00133EF8
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00133F03
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00133F5A
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00133F98
                                                                                                                                                                                                                                                                                                                                                                          • GetDriveTypeW.KERNEL32(?), ref: 00133FD6
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0013401E
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00134059
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00134087
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                                                                                                                                                                                                                                                                                                                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1839972693-4113822522
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 04c4f127418a6d123067e00d63641514a11b882ad0312244e10d68d4e545cebe
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e1324fc5dd033e8f354b299519768571aed88a4d96f33b628c37b87ee71531f3
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 04c4f127418a6d123067e00d63641514a11b882ad0312244e10d68d4e545cebe
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6871E4326043019FC714EF24C8819AEB7F4EF94758F50492DF8A697252EB31EE45CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 00125A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadIconW.USER32(00000063), ref: 00125A2E
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00125A40
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowTextW.USER32(?,?), ref: 00125A57
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EA), ref: 00125A6C
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowTextW.USER32(00000000,?), ref: 00125A72
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00125A82
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowTextW.USER32(00000000,?), ref: 00125A88
                                                                                                                                                                                                                                                                                                                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00125AA9
                                                                                                                                                                                                                                                                                                                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00125AC3
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00125ACC
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00125B33
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowTextW.USER32(?,?), ref: 00125B6F
                                                                                                                                                                                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00125B75
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 00125B7C
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00125BD3
                                                                                                                                                                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00125BE0
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000005,00000000,?), ref: 00125C05
                                                                                                                                                                                                                                                                                                                                                                          • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00125C2F
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 895679908-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4dc8b35a2e6ac1b94ede25e18b5fe45451c9df37b958aa25a92dd932edd23ae1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 01ead19fd84c7799bd9ebce1306edf65559687e8f77d4d2c062cf4c5e9ef6f6e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4dc8b35a2e6ac1b94ede25e18b5fe45451c9df37b958aa25a92dd932edd23ae1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9771AD31900B19EFDB20DFA8DE85AAEBBF6FF48705F104518E182A76A0D770E950CB50
                                                                                                                                                                                                                                                                                                                                                                          Function 0013FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 0013FE27
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 0013FE32
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 0013FE3D
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 0013FE48
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 0013FE53
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 0013FE5E
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F81), ref: 0013FE69
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 0013FE74
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F80), ref: 0013FE7F
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 0013FE8A
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 0013FE95
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 0013FEA0
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 0013FEAB
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 0013FEB6
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 0013FEC1
                                                                                                                                                                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 0013FECC
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorInfo.USER32(?), ref: 0013FEDC
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0013FF1E
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Cursor$Load$ErrorInfoLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3215588206-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 46e601b02e6e887497568bcdaf9b34c5cc6ee5fdec8574cf1ce6d2717dc663ba
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8227b8106438cdfcf4e1ad1017a549735355ed5643a1fb5fb64055f5f4fa9014
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 46e601b02e6e887497568bcdaf9b34c5cc6ee5fdec8574cf1ce6d2717dc663ba
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5D4124B1D04319AADB109FBA8C89C5EBFE8FF04754B50452AE51DEB281DB78D901CF91
                                                                                                                                                                                                                                                                                                                                                                          Function 000E00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 000E00C6
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0019070C,00000FA0,86FB93FA,?,?,?,?,001023B3,000000FF), ref: 000E011C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,001023B3,000000FF), ref: 000E0127
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,001023B3,000000FF), ref: 000E0138
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 000E014E
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 000E015C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 000E016A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 000E0195
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 000E01A0
                                                                                                                                                                                                                                                                                                                                                                          • ___scrt_fastfail.LIBCMT ref: 000E00E7
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00A3: __onexit.LIBCMT ref: 000E00A9
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          • SleepConditionVariableCS, xrefs: 000E0154
                                                                                                                                                                                                                                                                                                                                                                          • kernel32.dll, xrefs: 000E0133
                                                                                                                                                                                                                                                                                                                                                                          • api-ms-win-core-synch-l1-2-0.dll, xrefs: 000E0122
                                                                                                                                                                                                                                                                                                                                                                          • WakeAllConditionVariable, xrefs: 000E0162
                                                                                                                                                                                                                                                                                                                                                                          • InitializeConditionVariable, xrefs: 000E0148
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                                                                                                                                                                                                                                                                                                                                          • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 66158676-1714406822
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 760f69713b5321131463fec95190ac7a8132f6708318221ccf88951f578287c9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 236bb34a75d5f244cce21c7547222afc45e7153933c5d9457546064ce3327cfc
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 760f69713b5321131463fec95190ac7a8132f6708318221ccf88951f578287c9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C21F932645751EFE7115FB5AC45B6A33E4EB04B62F00012AF841BE692DFF09C808AD0
                                                                                                                                                                                                                                                                                                                                                                          Function 001230F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 176396367-1603158881
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 00c441e81a6089ce720a64ec8007df639cba6ee77662d1f387ecb5788f41c859
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 247c8405862d2c4b2935202e5087541e389075fec99b45b63e3c799692ec0870
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 00c441e81a6089ce720a64ec8007df639cba6ee77662d1f387ecb5788f41c859
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3E11632A00626ABCB18EF64D451BEDFBB1FF14710F15811AE466F7241DB34AFA58B90
                                                                                                                                                                                                                                                                                                                                                                          Function 001344C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CharLowerBuffW.USER32(00000000,00000000,0015CC08), ref: 00134527
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0013453B
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00134599
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001345F4
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0013463F
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001346A7
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DF9F2: _wcslen.LIBCMT ref: 000DF9FD
                                                                                                                                                                                                                                                                                                                                                                          • GetDriveTypeW.KERNEL32(?,00186BF0,00000061), ref: 00134743
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$BuffCharDriveLowerType
                                                                                                                                                                                                                                                                                                                                                                          • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2055661098-1000479233
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a920066676022d3eb3e7a9198d15f02f9475ea183588fe8ea76fed8333a5a424
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c103ab668acc3ceb852348c2e8eb574703daf677a8d59328495e2b5f83d6b7f0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a920066676022d3eb3e7a9198d15f02f9475ea183588fe8ea76fed8333a5a424
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51B122716083029FC710DF28C891AAEB7E4BFA5764F50491DF496D7292E730E944CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 00143FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,0015CC08), ref: 001440BB
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 001440CD
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0015CC08), ref: 001440F2
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,?,0015CC08), ref: 0014413E
                                                                                                                                                                                                                                                                                                                                                                          • StringFromGUID2.OLE32(?,?,00000028,?,0015CC08), ref: 001441A8
                                                                                                                                                                                                                                                                                                                                                                          • SysFreeString.OLEAUT32(00000009), ref: 00144262
                                                                                                                                                                                                                                                                                                                                                                          • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 001442C8
                                                                                                                                                                                                                                                                                                                                                                          • SysFreeString.OLEAUT32(?), ref: 001442F2
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                                                                                                                                                                                                                                                                                                                                          • String ID: GetModuleHandleExW$kernel32.dll
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 354098117-199464113
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a7ce5a45a06a3a801a3a4a005256586d1d59e5b252913a52ce681c337ac7ca90
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3c3b514c0ff2d360c41ce67fa40362df074de20b6a22c852abe0133463f44bc5
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a7ce5a45a06a3a801a3a4a005256586d1d59e5b252913a52ce681c337ac7ca90
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 97122775A00219EFDB14CF94C884EAEBBB5BF45314F258098F905AB261D731ED86CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000C326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemCount.USER32(00191990), ref: 00102F8D
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemCount.USER32(00191990), ref: 0010303D
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00103081
                                                                                                                                                                                                                                                                                                                                                                          • SetForegroundWindow.USER32(00000000), ref: 0010308A
                                                                                                                                                                                                                                                                                                                                                                          • TrackPopupMenuEx.USER32(00191990,00000000,?,00000000,00000000,00000000), ref: 0010309D
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 001030A9
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 36266755-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9889443a608f560bdcc809eb3ef91425c2a7764c931ca62b85d1fdd47d21ce77
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3a08711eb1169e27aa523df3b0738d10d8216f2ce975fdcf56c8612a88a28428
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9889443a608f560bdcc809eb3ef91425c2a7764c931ca62b85d1fdd47d21ce77
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2371F370644216BFEB259F64DC89FAEBF68FF05364F208216F5256A1E0C7B1A950CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00156CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(00000000,?), ref: 00156DEB
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00156E5F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00156E81
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00156E94
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 00156EB5
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,000C0000,00000000), ref: 00156EE4
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00156EFD
                                                                                                                                                                                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00156F16
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 00156F1D
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00156F35
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00156F4D
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9944: GetWindowLongW.USER32(?,000000EB), ref: 000D9952
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0$tooltips_class32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2429346358-3619404913
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7eaa074694f524a8d4f232a1e85890d5640e446b0e7a9fb2d493316559fde984
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d2980b75ff6e75737208885cc1f0d7b50dc683c001117cde9582acf292676948
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7eaa074694f524a8d4f232a1e85890d5640e446b0e7a9fb2d493316559fde984
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34717970504341EFDB21CF18DC54FAABBE9FB99305F44051EF9998B261C770A98ACB91
                                                                                                                                                                                                                                                                                                                                                                          Function 0015911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          • DragQueryPoint.SHELL32(?,?), ref: 00159147
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00157674: ClientToScreen.USER32(?,?), ref: 0015769A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00157674: GetWindowRect.USER32(?,?), ref: 00157710
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00157674: PtInRect.USER32(?,?,00158B89), ref: 00157720
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 001591B0
                                                                                                                                                                                                                                                                                                                                                                          • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 001591BB
                                                                                                                                                                                                                                                                                                                                                                          • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 001591DE
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00159225
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 0015923E
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 00159255
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 00159277
                                                                                                                                                                                                                                                                                                                                                                          • DragFinish.SHELL32(?), ref: 0015927E
                                                                                                                                                                                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00159371
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 221274066-3440237614
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b8959c2d926252fc0efe45f2c3facacfe9743d327c6a795543d0d92941d11c24
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8f56bcae9c06a40d9ba44279aef907fe2b3af17fbbcf772b7234567bf0220311
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b8959c2d926252fc0efe45f2c3facacfe9743d327c6a795543d0d92941d11c24
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7D616B71108301EFD701EF64DC85EAFBBE8EF89750F00092EF5A5961A1DB709A49CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 0013C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0013C4B0
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0013C4C3
                                                                                                                                                                                                                                                                                                                                                                          • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0013C4D7
                                                                                                                                                                                                                                                                                                                                                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0013C4F0
                                                                                                                                                                                                                                                                                                                                                                          • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0013C533
                                                                                                                                                                                                                                                                                                                                                                          • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0013C549
                                                                                                                                                                                                                                                                                                                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0013C554
                                                                                                                                                                                                                                                                                                                                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0013C584
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0013C5DC
                                                                                                                                                                                                                                                                                                                                                                          • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0013C5F0
                                                                                                                                                                                                                                                                                                                                                                          • InternetCloseHandle.WININET(00000000), ref: 0013C5FB
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3800310941-3916222277
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d19888c2a921183d54c650650c8e2e847c450c8aa866fa2d91dd59d42f53eed4
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5f23fd5e2e8e4be735ef458e4e079bc816384679c890b866a131984e1052eb96
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d19888c2a921183d54c650650c8e2e847c450c8aa866fa2d91dd59d42f53eed4
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC514AB1600709FFDB219FA4CD88AAB7BBCFF08755F004419F945AA610DB35E944DBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0015856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00158592
                                                                                                                                                                                                                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 001585A2
                                                                                                                                                                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 001585AD
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 001585BA
                                                                                                                                                                                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 001585C8
                                                                                                                                                                                                                                                                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 001585D7
                                                                                                                                                                                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 001585E0
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 001585E7
                                                                                                                                                                                                                                                                                                                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 001585F8
                                                                                                                                                                                                                                                                                                                                                                          • OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0015FC38,?), ref: 00158611
                                                                                                                                                                                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00158621
                                                                                                                                                                                                                                                                                                                                                                          • GetObjectW.GDI32(?,00000018,?), ref: 00158641
                                                                                                                                                                                                                                                                                                                                                                          • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00158671
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 00158699
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 001586AF
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3840717409-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0c8fa17a97642f755febb525b334915dbabbf168e3137a1df8689729a8cbff3e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b0f1f65f32c0a6856486671a90a9eadb47acc76410925d20c70a015f5acbdc6c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c8fa17a97642f755febb525b334915dbabbf168e3137a1df8689729a8cbff3e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D411975600308EFDB119FA5CC88EAA7BB8FF89716F104158F916EB260DB309945CF60
                                                                                                                                                                                                                                                                                                                                                                          Function 001314BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(00000000), ref: 00131502
                                                                                                                                                                                                                                                                                                                                                                          • VariantCopy.OLEAUT32(?,?), ref: 0013150B
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00131517
                                                                                                                                                                                                                                                                                                                                                                          • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 001315FB
                                                                                                                                                                                                                                                                                                                                                                          • VarR8FromDec.OLEAUT32(?,?), ref: 00131657
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 00131708
                                                                                                                                                                                                                                                                                                                                                                          • SysFreeString.OLEAUT32(?), ref: 0013178C
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 001317D8
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 001317E7
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(00000000), ref: 00131823
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1234038744-3931177956
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b535db231bafdeeda101df038eb774179aa66f62c7cd12c978e4c5b102c68533
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0915a7c330b09240b3886f15c830174774ab2cfe60df5b1d81c46a24b7f5bf9a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b535db231bafdeeda101df038eb774179aa66f62c7cd12c978e4c5b102c68533
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFD11031A00205FFDB18AF65E885BBDB7B5BF46700F15845AF806AB681DB30EC45DBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 0014B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014C9F1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA68
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA9E
                                                                                                                                                                                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014B6F4
                                                                                                                                                                                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0014B772
                                                                                                                                                                                                                                                                                                                                                                          • RegDeleteValueW.ADVAPI32(?,?), ref: 0014B80A
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 0014B87E
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 0014B89C
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(advapi32.dll), ref: 0014B8F2
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0014B904
                                                                                                                                                                                                                                                                                                                                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 0014B922
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000), ref: 0014B983
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0014B994
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                                                                                                                                                                                                                                                                                                                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 146587525-4033151799
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4e75b5ab40649feb6a14b9eedfbce8ae7dfd754ca8cbc32c0d7f60eded4c0608
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8fbe726e8f38adfeba607226fa23e26b618d025a73c7fa4f196586af40bcc72d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4e75b5ab40649feb6a14b9eedfbce8ae7dfd754ca8cbc32c0d7f60eded4c0608
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4C17874208202EFD714DF24C4D5F6ABBE5BF84318F14849CF49A8B6A2CB71E946CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 0014255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 001425D8
                                                                                                                                                                                                                                                                                                                                                                          • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 001425E8
                                                                                                                                                                                                                                                                                                                                                                          • CreateCompatibleDC.GDI32(?), ref: 001425F4
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 00142601
                                                                                                                                                                                                                                                                                                                                                                          • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0014266D
                                                                                                                                                                                                                                                                                                                                                                          • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 001426AC
                                                                                                                                                                                                                                                                                                                                                                          • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 001426D0
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 001426D8
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 001426E1
                                                                                                                                                                                                                                                                                                                                                                          • DeleteDC.GDI32(?), ref: 001426E8
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,?), ref: 001426F3
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                                                                                                                                                                                                                                                                                                                          • String ID: (
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2598888154-3887548279
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 13e9af2f1b2b5563c35ccb5cc23b15940bc7cb25cf8b2aaf28392235861634cb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4c2e3508312c2c9584858dc80d611fe734d5d996d389a6372e76109831cfebda
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 13e9af2f1b2b5563c35ccb5cc23b15940bc7cb25cf8b2aaf28392235861634cb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C861C2B5D00319EFCF04CFA4D884AAEBBB6FF58310F208529E955A7250D774A991CFA4
                                                                                                                                                                                                                                                                                                                                                                          Function 000FDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • ___free_lconv_mon.LIBCMT ref: 000FDAA1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD659
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD66B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD67D
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD68F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6A1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6B3
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6C5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6D7
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6E9
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD6FB
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD70D
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD71F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD63C: _free.LIBCMT ref: 000FD731
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDA96
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: HeapFree.KERNEL32(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDAB8
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDACD
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDAD8
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDAFA
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDB0D
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDB1B
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDB26
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDB5E
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDB65
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDB82
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FDB9A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 161543041-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 44a7414a05fab99229b56e84bab1b8cc108dcfb15be0be11828b64f3651803f2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 54801464c650d73b0089b187211de4d4d6f7d060ebbdc5af317783c079803a48
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 44a7414a05fab99229b56e84bab1b8cc108dcfb15be0be11828b64f3651803f2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C315D31648209DFDB61AA38E845BBA77EAFF00311F11451AE648D7992DB71EC40A724
                                                                                                                                                                                                                                                                                                                                                                          Function 0012365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 0012369C
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001236A7
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00123797
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 0012380C
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgCtrlID.USER32(?), ref: 0012385D
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00123882
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32(?), ref: 001238A0
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(00000000), ref: 001238A7
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00123921
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 0012395D
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %s%u
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4010501982-679674701
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 135b83dd3335524cf894bf577f3feb09718d20ee3008f27bca49594049512905
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 480a31db8b32b5e535182d0387b0e098785cb1b9e162939a7e21de1952dec1e7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 135b83dd3335524cf894bf577f3feb09718d20ee3008f27bca49594049512905
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E91E371204316AFDB08DF24D884BEAF7A9FF45304F004619F9A9D6190DB34EAA5CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 00124954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00124994
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 001249DA
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001249EB
                                                                                                                                                                                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,00000000), ref: 001249F7
                                                                                                                                                                                                                                                                                                                                                                          • _wcsstr.LIBVCRUNTIME ref: 00124A2C
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 00124A64
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00124A9D
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 00124AE6
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00124B20
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00124B8B
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ThumbnailClass
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1311036022-1241985126
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 308d0c42f6f7124e3cab3b6a753846d4b14354525f4da66b29aee3a1368a4e52
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5090bb3938485a6161690a36c5c875d10435fc34155902632d65c64268a50c82
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 308d0c42f6f7124e3cab3b6a753846d4b14354525f4da66b29aee3a1368a4e52
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D91DE710043259FDB04DF14E985FAA77E8FF84314F048469FD869A196EB30EE65CBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 00158D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00158D5A
                                                                                                                                                                                                                                                                                                                                                                          • GetFocus.USER32 ref: 00158D6A
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 00158D75
                                                                                                                                                                                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00158E1D
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00158ECF
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemCount.USER32(?), ref: 00158EEC
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemID.USER32(?,00000000), ref: 00158EFC
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00158F2E
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00158F70
                                                                                                                                                                                                                                                                                                                                                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00158FA1
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1026556194-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4692ccb5d3a39ef62f5640288b00ba5e05948ad97a5f0266e0970b3b28a93115
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: af844f726131f46bf7bccf6ea476c6bea17e437a341c74bff9174a86be3cb9b8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4692ccb5d3a39ef62f5640288b00ba5e05948ad97a5f0266e0970b3b28a93115
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5881AF71604301EFD710CF24C885AABB7E9FB88355F04091AFDA5AB291DB70DD49CBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 0012BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(00191990,000000FF,00000000,00000030), ref: 0012BFAC
                                                                                                                                                                                                                                                                                                                                                                          • SetMenuItemInfoW.USER32(00191990,00000004,00000000,00000030), ref: 0012BFE1
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(000001F4), ref: 0012BFF3
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemCount.USER32(?), ref: 0012C039
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemID.USER32(?,00000000), ref: 0012C056
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemID.USER32(?,-00000001), ref: 0012C082
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemID.USER32(?,?), ref: 0012C0C9
                                                                                                                                                                                                                                                                                                                                                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0012C10F
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0012C124
                                                                                                                                                                                                                                                                                                                                                                          • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0012C145
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1460738036-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: dd7b40be28e83d18e2be8b5af2b11344e51f5be6070ad57782e8ae72e00cc6bb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c86eed222bebbf01e171fc6fa06880ad389cd12d8aee5ca19b3b10d34afd9baa
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dd7b40be28e83d18e2be8b5af2b11344e51f5be6070ad57782e8ae72e00cc6bb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E619E70A00366EFDB15CF64ED89AEEBBB8EF05344F140015FA01A7291D731AE65CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0012DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetFileVersionInfoSizeW.VERSION(?,?), ref: 0012DC20
                                                                                                                                                                                                                                                                                                                                                                          • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0012DC46
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012DC50
                                                                                                                                                                                                                                                                                                                                                                          • _wcsstr.LIBVCRUNTIME ref: 0012DCA0
                                                                                                                                                                                                                                                                                                                                                                          • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0012DCBC
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1939486746-1459072770
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: af983474d1ae37eda9c78910fb0b423fa9a85d2f6e952fca42986a0a991dba21
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2a1cc05b5ad6869759eb14e684a51ea5eebc6631de531b13ed35e3c05582e572
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: af983474d1ae37eda9c78910fb0b423fa9a85d2f6e952fca42986a0a991dba21
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F641F032940315BEDB04ABA5EC07EFF37ACEF56750F10406AF901B6183EB759A1087A5
                                                                                                                                                                                                                                                                                                                                                                          Function 0014CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0014CC64
                                                                                                                                                                                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0014CC8D
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0014CD48
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0014CCAA
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0014CCBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0014CCCF
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0014CD05
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0014CD28
                                                                                                                                                                                                                                                                                                                                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 0014CCF3
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                                                                                                                                                                                                                                                                                                                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2734957052-4033151799
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d0af634a031b4a05b1823aec30b54fa9eda5a19ba3d89a7935f3658f370c6403
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 17e2d857282f53764eb53dca7a893d6bf258bca37461a61be06c5ec37b728b77
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d0af634a031b4a05b1823aec30b54fa9eda5a19ba3d89a7935f3658f370c6403
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2316975902229FBDB209F94DC88EEFBB7CEF45751F000165B906E6260DB309A85DAE0
                                                                                                                                                                                                                                                                                                                                                                          Function 00133D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00133D40
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00133D6D
                                                                                                                                                                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00133D9D
                                                                                                                                                                                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00133DBE
                                                                                                                                                                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?), ref: 00133DCE
                                                                                                                                                                                                                                                                                                                                                                          • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00133E55
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00133E60
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00133E6B
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: :$\$\??\%s
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1149970189-3457252023
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e2d8c329fcc4c14f5a61f8cb2a95ba4b11d595abf7eba5e790a9bfe804e0bc0c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ef5e767c80928eb84f85cfa2056a9666bc53ce23669ed370d4d7d9ffa64e9293
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e2d8c329fcc4c14f5a61f8cb2a95ba4b11d595abf7eba5e790a9bfe804e0bc0c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6F31A171900209ABDB219FA0DC49FEB37BDEF88701F5040B6F619E6061EB7497848B68
                                                                                                                                                                                                                                                                                                                                                                          Function 0012E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • timeGetTime.WINMM ref: 0012E6B4
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DE551: timeGetTime.WINMM(?,?,0012E6D4), ref: 000DE555
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(0000000A), ref: 0012E6E1
                                                                                                                                                                                                                                                                                                                                                                          • EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0012E705
                                                                                                                                                                                                                                                                                                                                                                          • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0012E727
                                                                                                                                                                                                                                                                                                                                                                          • SetActiveWindow.USER32 ref: 0012E746
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0012E754
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000010,00000000,00000000), ref: 0012E773
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(000000FA), ref: 0012E77E
                                                                                                                                                                                                                                                                                                                                                                          • IsWindow.USER32 ref: 0012E78A
                                                                                                                                                                                                                                                                                                                                                                          • EndDialog.USER32(00000000), ref: 0012E79B
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                                                                                                                                                                                                                                                                                                                          • String ID: BUTTON
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1194449130-3405671355
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: f1666b891133d20e7e25230337679ec41063a87a9ab86da56b3d1505cc3b3cef
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a58cd018d3710180bd8d65ffac8d44d0f9de0e42b03d2402974624867fe727ad
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1666b891133d20e7e25230337679ec41063a87a9ab86da56b3d1505cc3b3cef
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A21A570204315FFEB105F60FCC9A253BA9F75474AF200426F91686EB2DB71ADE08BA4
                                                                                                                                                                                                                                                                                                                                                                          Function 0012E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0012EA5D
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0012EA73
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0012EA84
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0012EA96
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0012EAA7
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: SendString$_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2420728520-1007645807
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 2142bb915ad185d3f43c4d5aea8c94bd5a6eb44fe6d9736b7a9bcef4bdf08632
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4fea441773fe8b1a09985cf6a30ba43b2cd82b4a57931bd6c05a91cf430b7c37
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2142bb915ad185d3f43c4d5aea8c94bd5a6eb44fe6d9736b7a9bcef4bdf08632
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE112131A902697DD724B7A1EC4AEFF6ABCEBD1B04F400429B411A20D1EF705A55CAB0
                                                                                                                                                                                                                                                                                                                                                                          Function 00129F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyboardState.USER32(?), ref: 0012A012
                                                                                                                                                                                                                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 0012A07D
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 0012A09D
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(000000A0), ref: 0012A0B4
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 0012A0E3
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(000000A1), ref: 0012A0F4
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000011), ref: 0012A120
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 0012A12E
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000012), ref: 0012A157
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(00000012), ref: 0012A165
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 0012A18E
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(0000005B), ref: 0012A19C
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: State$Async$Keyboard
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 541375521-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4f1fc1f58f8a103ce5eea1b42c95852588cf6bb96c88e3c4ec803a143ac97294
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 31eac235040f3ab7f83e59c9af97000a8d3e053d9c4869e1257ca020fd28132a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f1fc1f58f8a103ce5eea1b42c95852588cf6bb96c88e3c4ec803a143ac97294
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 74513B309047A86BFB35DBB0A9107EABFF49F12380F484589D5C25B1C2DB54AA5CCB63
                                                                                                                                                                                                                                                                                                                                                                          Function 00125CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000001), ref: 00125CE2
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00125CFB
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00125D59
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000002), ref: 00125D69
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00125D7B
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00125DCF
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00125DDD
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00125DEF
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00125E31
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EA), ref: 00125E44
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00125E5A
                                                                                                                                                                                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00125E67
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3096461208-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d24021537454a9bf3f907bff1e5ebea5b89bb2bab4d9252a0a944edb1858ad3e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e0b0a436e47fad12bc0bf8fb4459cd6f825917ef28f508afe612e0341c615152
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d24021537454a9bf3f907bff1e5ebea5b89bb2bab4d9252a0a944edb1858ad3e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 23510E71A00719AFDB18CFA8DD89AAEBBB6FB48301F148129F515E6690D7709E50CB60
                                                                                                                                                                                                                                                                                                                                                                          Function 000D8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,000D8BE8,?,00000000,?,?,?,?,000D8BBA,00000000,?), ref: 000D8FC5
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 000D8C81
                                                                                                                                                                                                                                                                                                                                                                          • KillTimer.USER32(00000000,?,?,?,?,000D8BBA,00000000,?), ref: 000D8D1B
                                                                                                                                                                                                                                                                                                                                                                          • DestroyAcceleratorTable.USER32(00000000), ref: 00116973
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,000D8BBA,00000000,?), ref: 001169A1
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,000D8BBA,00000000,?), ref: 001169B8
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,000D8BBA,00000000), ref: 001169D4
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 001169E6
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 641708696-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4a060a5a6ba761a35917cdb94e5adba54827bc5c7a44a6de5f4502540710a681
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4a78b3fe1fae012fc03417ef33207089292cc313ab8526b2cb5d0c57e93de223
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4a060a5a6ba761a35917cdb94e5adba54827bc5c7a44a6de5f4502540710a681
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD615B31512705EFCB359F14D958B69B7F1FB40316F14952EE0429BAA0CB72A9D0DFA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000D9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9944: GetWindowLongW.USER32(?,000000EB), ref: 000D9952
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 000D9862
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ColorLongWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 259745315-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 96ca41e5ccdc8fe27e111c38c50eef29cd3f8d4002b39584020aa135d6538297
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 14cfb096628b35d54e8bcd075968483ad8bad871b7f520c589705faf64c6e289
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 96ca41e5ccdc8fe27e111c38c50eef29cd3f8d4002b39584020aa135d6538297
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 35418331104740EFDB205F389C84BB977A6AB46731F144616F9A28B3E1DB319D81EB70
                                                                                                                                                                                                                                                                                                                                                                          Function 001296E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0010F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00129717
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000000,?,0010F7F8,00000001), ref: 00129720
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0010F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00129742
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000000,?,0010F7F8,00000001), ref: 00129745
                                                                                                                                                                                                                                                                                                                                                                          • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00129866
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: HandleLoadModuleString$Message_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 747408836-2268648507
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e5fc23027440f85a10d2c9c7e3f87513130c49c3ed5a4931eb71d589f0c4b494
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5876df78d53a17464e70d115a336cc4da9f8bdc0eb4f0bc5b85f1fca4be8a5fe
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e5fc23027440f85a10d2c9c7e3f87513130c49c3ed5a4931eb71d589f0c4b494
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A413D72900219AADF14FBE4DD86EEE7778AF15340F504129F60672092EF356F58CB61
                                                                                                                                                                                                                                                                                                                                                                          Function 001206DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A
                                                                                                                                                                                                                                                                                                                                                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 001207A2
                                                                                                                                                                                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 001207BE
                                                                                                                                                                                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 001207DA
                                                                                                                                                                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00120804
                                                                                                                                                                                                                                                                                                                                                                          • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0012082C
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00120837
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0012083C
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 323675364-22481851
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4bb11b2108d3daf2a92c0ab430004c1664d622db696f67f984437899e420f64a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: de6f8bf96aeee6857be974838c53e2b797d65c6300a1f1f802d0518801f81bc0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4bb11b2108d3daf2a92c0ab430004c1664d622db696f67f984437899e420f64a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E341E476D10229AFDB11EFA4DC85DEEB778FF48354B044129F901A71A2EB309E54CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00153F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0015403B
                                                                                                                                                                                                                                                                                                                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 00154042
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00154055
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0015405D
                                                                                                                                                                                                                                                                                                                                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 00154068
                                                                                                                                                                                                                                                                                                                                                                          • DeleteDC.GDI32(00000000), ref: 00154072
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 0015407C
                                                                                                                                                                                                                                                                                                                                                                          • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00154092
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 0015409E
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID: static
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2559357485-2160076837
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 091d854a50c51e37b2030eab73277393d9dea0721da431e4c0a3261cf0f54101
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7968fc448a6dc3f2a670f2fc497576012108683754f6bf4468fa173b176815a2
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 091d854a50c51e37b2030eab73277393d9dea0721da431e4c0a3261cf0f54101
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 32317C32500315EFDF219FA4DC48FDA3B69EF0D366F110211FA25AA1A0C775D895DB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00143C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 00143C5C
                                                                                                                                                                                                                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 00143C8A
                                                                                                                                                                                                                                                                                                                                                                          • CoUninitialize.OLE32 ref: 00143C94
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00143D2D
                                                                                                                                                                                                                                                                                                                                                                          • GetRunningObjectTable.OLE32(00000000,?), ref: 00143DB1
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001,00000029), ref: 00143ED5
                                                                                                                                                                                                                                                                                                                                                                          • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00143F0E
                                                                                                                                                                                                                                                                                                                                                                          • CoGetObject.OLE32(?,00000000,0015FB98,?), ref: 00143F2D
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000000), ref: 00143F40
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00143FC4
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00143FD8
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 429561992-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 85be2c767c776b56c02f5d746bc9f2c1c05caf88e5439ccf48afb8b93c69f85e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: bf9b1c57f587a15db3651fe17e555c5cfcb80080e9e6a9a1d19609d508ccd787
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 85be2c767c776b56c02f5d746bc9f2c1c05caf88e5439ccf48afb8b93c69f85e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9C123716083019FD700DF68C88496BB7E9FF89744F10491DF99A9B261D731EE46CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 00137A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 00137AF3
                                                                                                                                                                                                                                                                                                                                                                          • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00137B8F
                                                                                                                                                                                                                                                                                                                                                                          • SHGetDesktopFolder.SHELL32(?), ref: 00137BA3
                                                                                                                                                                                                                                                                                                                                                                          • CoCreateInstance.OLE32(0015FD08,00000000,00000001,00186E6C,?), ref: 00137BEF
                                                                                                                                                                                                                                                                                                                                                                          • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00137C74
                                                                                                                                                                                                                                                                                                                                                                          • CoTaskMemFree.OLE32(?,?), ref: 00137CCC
                                                                                                                                                                                                                                                                                                                                                                          • SHBrowseForFolderW.SHELL32(?), ref: 00137D57
                                                                                                                                                                                                                                                                                                                                                                          • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00137D7A
                                                                                                                                                                                                                                                                                                                                                                          • CoTaskMemFree.OLE32(00000000), ref: 00137D81
                                                                                                                                                                                                                                                                                                                                                                          • CoTaskMemFree.OLE32(00000000), ref: 00137DD6
                                                                                                                                                                                                                                                                                                                                                                          • CoUninitialize.OLE32 ref: 00137DDC
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2762341140-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c469d6ac5580fd0aeb7be12fc5310bb0b2f6ac471f69f377a5af8dda8ff7e4ad
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f0c3504625483b165e4b9c42c63b18c625737d6a8c6a15e751a433dda88d5b96
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c469d6ac5580fd0aeb7be12fc5310bb0b2f6ac471f69f377a5af8dda8ff7e4ad
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 17C1EA75A04209AFCB14DFA4C884DAEBBF9FF48314F148499E8199B662D731EE45CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 0015541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00155504
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00155515
                                                                                                                                                                                                                                                                                                                                                                          • CharNextW.USER32(00000158), ref: 00155544
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00155585
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0015559B
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001555AC
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$CharNext
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1350042424-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6e2bb8ecdbd72e361acbca0e8c431f025595fdaa690cd0dfe625722e8ca9b562
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7ee0a0b14d8fb4fd04923b4e9f5abff2cb74e370b505bf5d8549d86ed8c4a423
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e2bb8ecdbd72e361acbca0e8c431f025595fdaa690cd0dfe625722e8ca9b562
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37617C30904609EFDF109F94CC95AFE7BBAFB09726F104145F935AE290E7749A88DB60
                                                                                                                                                                                                                                                                                                                                                                          Function 0011FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0011FAAF
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayAllocData.OLEAUT32(?), ref: 0011FB08
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 0011FB1A
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(?,?), ref: 0011FB3A
                                                                                                                                                                                                                                                                                                                                                                          • VariantCopy.OLEAUT32(?,?), ref: 0011FB8D
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(?), ref: 0011FBA1
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 0011FBB6
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayDestroyData.OLEAUT32(?), ref: 0011FBC3
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0011FBCC
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 0011FBDE
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0011FBE9
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2706829360-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c6c68d8941ae88bd72afc0fb0589d402170e194057bb1ef3e655bba06954b599
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b4cb496ccc4a2975796af34420fc9f6ad9b866fa8f6d292d2dd75eb1752ee07c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c6c68d8941ae88bd72afc0fb0589d402170e194057bb1ef3e655bba06954b599
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E0415F75A00319DFCB04DF64D854DEEBBB9FF58345F008079E945AB261DB30A986CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00129C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyboardState.USER32(?), ref: 00129CA1
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00129D22
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(000000A0), ref: 00129D3D
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00129D57
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(000000A1), ref: 00129D6C
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000011), ref: 00129D84
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 00129D96
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000012), ref: 00129DAE
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(00000012), ref: 00129DC0
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00129DD8
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyState.USER32(0000005B), ref: 00129DEA
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: State$Async$Keyboard
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 541375521-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 1b620b3900e70a997cfca1c9bf225d2bec416e30a6ca06fcfdb947a8610949a0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7c9cd0d0256c75f54ab36da518254ac273a8ebc6ac2c2c9a1e88b229d29df6eb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b620b3900e70a997cfca1c9bf225d2bec416e30a6ca06fcfdb947a8610949a0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0741FC345047DE6DFF348BA8E4043B5BEE06F11344F04805ED6C65A5C2E7A499F4D7A2
                                                                                                                                                                                                                                                                                                                                                                          Function 0014055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • WSAStartup.WSOCK32(00000101,?), ref: 001405BC
                                                                                                                                                                                                                                                                                                                                                                          • inet_addr.WSOCK32(?), ref: 0014061C
                                                                                                                                                                                                                                                                                                                                                                          • gethostbyname.WSOCK32(?), ref: 00140628
                                                                                                                                                                                                                                                                                                                                                                          • IcmpCreateFile.IPHLPAPI ref: 00140636
                                                                                                                                                                                                                                                                                                                                                                          • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 001406C6
                                                                                                                                                                                                                                                                                                                                                                          • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 001406E5
                                                                                                                                                                                                                                                                                                                                                                          • IcmpCloseHandle.IPHLPAPI(?), ref: 001407B9
                                                                                                                                                                                                                                                                                                                                                                          • WSACleanup.WSOCK32 ref: 001407BF
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Ping
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1028309954-2246546115
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e04a967a948f5083d480ffa0c69e77473192575e48ab0873ad07416d57180fe3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 46ec6937932cda903066112976072cb269d454940828f2c1cd91040e92de4694
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e04a967a948f5083d480ffa0c69e77473192575e48ab0873ad07416d57180fe3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C916E355047019FD321DF16C889F1ABBE0EF48319F1585A9E5AA8BAB2C730ED45CF92
                                                                                                                                                                                                                                                                                                                                                                          Function 00148CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$BuffCharLower
                                                                                                                                                                                                                                                                                                                                                                          • String ID: cdecl$none$stdcall$winapi
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 707087890-567219261
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 529fce010819f0901a7c7c537ecda959fbbcf596872a6b4daf42c90e3193fd42
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 37b8f98a9e250c87da76ce246a956fe6c76d74ab0641e8e85e6da8600c6f535a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 529fce010819f0901a7c7c537ecda959fbbcf596872a6b4daf42c90e3193fd42
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 82519F31A011169BCB24EFACC9509BEB7A5BF64724B214229E826F72D5EF31DE41C790
                                                                                                                                                                                                                                                                                                                                                                          Function 0014372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CoInitialize.OLE32 ref: 00143774
                                                                                                                                                                                                                                                                                                                                                                          • CoUninitialize.OLE32 ref: 0014377F
                                                                                                                                                                                                                                                                                                                                                                          • CoCreateInstance.OLE32(?,00000000,00000017,0015FB78,?), ref: 001437D9
                                                                                                                                                                                                                                                                                                                                                                          • IIDFromString.OLE32(?,?), ref: 0014384C
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 001438E4
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00143936
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 636576611-1287834457
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a2f729999ce0ac02f53c5ed030f86bd5d29dd38925622c5abc9aac32804f275a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a68b9cca5c21f14b03ff3c3909b64a83985707390734239b18386596a754176e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a2f729999ce0ac02f53c5ed030f86bd5d29dd38925622c5abc9aac32804f275a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E619F70608302AFD311DF54C849F6ABBE4EF48715F10091DF9A59B2A1D770EE49CBA2
                                                                                                                                                                                                                                                                                                                                                                          Function 00133388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 001333CF
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 001333F0
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: LoadString$_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4099089115-3080491070
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d7625bdf24d03eb3d78f9f2c8bafcf8052686071f11ab51986899ab46b9fe09d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 36e924fd50358d9118c302788eddd9b6c2222d9d206992a04a254c8bf0dac739
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d7625bdf24d03eb3d78f9f2c8bafcf8052686071f11ab51986899ab46b9fe09d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA517C7290020ABADF15EBA0DD46EEEB778AF14340F204169F515720A2EB356F98DF61
                                                                                                                                                                                                                                                                                                                                                                          Function 0012B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$BuffCharUpper
                                                                                                                                                                                                                                                                                                                                                                          • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1256254125-769500911
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b53632d311ad8e95ef8a9045ac252e67e1e1828d94205ee387cd560b13aaa189
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d3bcebea20d4e0d57a056aa1387da062dee46b0589d058004ca93f7bf07b3795
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b53632d311ad8e95ef8a9045ac252e67e1e1828d94205ee387cd560b13aaa189
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A241F632A081379BCB206F7DD9D05BE77A5BFA0B54B254229E422EB285F731CD91C790
                                                                                                                                                                                                                                                                                                                                                                          Function 00135393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 001353A0
                                                                                                                                                                                                                                                                                                                                                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00135416
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00135420
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000000,READY), ref: 001354A7
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                                                                                                                                                                                                                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4194297153-14809454
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4081636c80a8997c774608b7ae5de75718b1bb8d793b99d4416d7a23f8ebc72c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0315036e26ba01cc1ce12fe7910c2a295f220f09759db5f0bde4934cd67933d9
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4081636c80a8997c774608b7ae5de75718b1bb8d793b99d4416d7a23f8ebc72c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FF318D35A00604DFC718DF68C984FAABBB5EB45715F148069E805DB292EB71DE86CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00153C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateMenu.USER32 ref: 00153C79
                                                                                                                                                                                                                                                                                                                                                                          • SetMenu.USER32(?,00000000), ref: 00153C88
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00153D10
                                                                                                                                                                                                                                                                                                                                                                          • IsMenu.USER32(?), ref: 00153D24
                                                                                                                                                                                                                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 00153D2E
                                                                                                                                                                                                                                                                                                                                                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00153D5B
                                                                                                                                                                                                                                                                                                                                                                          • DrawMenuBar.USER32 ref: 00153D63
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0$F
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 161812096-3044882817
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6772cbe6385cfe6006e3d71b71bc939022e5bd81208c55377085fe4f47a40b1a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9f46a3dc4b3be3834a698d122e9fd438318998bec5941e9d471f1785ca7643af
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6772cbe6385cfe6006e3d71b71bc939022e5bd81208c55377085fe4f47a40b1a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 64415675A01309EFDB14CFA4D844BAA7BB5FF49391F140029ED66AB360D770AA54CF90
                                                                                                                                                                                                                                                                                                                                                                          Function 00121EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00121F64
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgCtrlID.USER32 ref: 00121F6F
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32 ref: 00121F8B
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00121F8E
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgCtrlID.USER32(?), ref: 00121F97
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32(?), ref: 00121FAB
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00121FAE
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 711023334-1403004172
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: aa8f7ef9871606c420abb98dfd607f8b6098e6ac083c8e1d4f139a7c1ee80cc8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6b52fd3a0c6a7ee6e3caa7dad738c3022a4dc41338a2a09a1e30f5e4b449cef3
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: aa8f7ef9871606c420abb98dfd607f8b6098e6ac083c8e1d4f139a7c1ee80cc8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B21C270900224BFCF04EFA0DC85EEEBBB9EF19350B000119F961672D1DB345A68DBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00121FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00122043
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgCtrlID.USER32 ref: 0012204E
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32 ref: 0012206A
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 0012206D
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgCtrlID.USER32(?), ref: 00122076
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32(?), ref: 0012208A
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 0012208D
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 711023334-1403004172
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b75bbc703fe5a63fd9046756e3b5374410122494d61ff8033adf45b6b2fb05b0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4ce01c5a52e68795f26b9edb8fc0bddad3bde46f4d12dfa3402c7b0f7c397894
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b75bbc703fe5a63fd9046756e3b5374410122494d61ff8033adf45b6b2fb05b0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5121C271A00214BFCF14AFA0DC85EEEBBB8EF15340F000415F951A72A1CB795A64DB64
                                                                                                                                                                                                                                                                                                                                                                          Function 00153A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00153A9D
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00153AA0
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00153AC7
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00153AEA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00153B62
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00153BAC
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00153BC7
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00153BE2
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00153BF6
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00153C13
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$LongWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 312131281-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 268f5ab9cf9e56b9a3c2797d187ac24cb93fddb279d7ca1405e4db3bb1196884
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 155fd9d9a430ba34d66c5c31a73d9773ebc8ebe6383cab2034a8a8e962f4848e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 268f5ab9cf9e56b9a3c2797d187ac24cb93fddb279d7ca1405e4db3bb1196884
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 03617D75900248EFDB11DF68CC81EEE77B8EB09704F10019AFA25EB291C770AE85DB50
                                                                                                                                                                                                                                                                                                                                                                          Function 000F2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2C94
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: HeapFree.KERNEL32(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CA0
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CAB
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CB6
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CC1
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CCC
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CD7
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CE2
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CED
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2CFB
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 776569668-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: bd737444ddd361eafb8904c17dcadaf450d54171f6ce728c3f809bb29af24c87
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 10e61f7a2a8d8b55aa6a3d7b340f591bd50aa01bd28e6629b71deda7e320edcf
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd737444ddd361eafb8904c17dcadaf450d54171f6ce728c3f809bb29af24c87
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6711937614410DAFCB02EF94D982CED3BA5FF05350F4144A5FA489BA22DA71EA50AB90
                                                                                                                                                                                                                                                                                                                                                                          Function 000C1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 000C1459
                                                                                                                                                                                                                                                                                                                                                                          • OleUninitialize.OLE32(?,00000000), ref: 000C14F8
                                                                                                                                                                                                                                                                                                                                                                          • UnregisterHotKey.USER32(?), ref: 000C16DD
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 001024B9
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0010251E
                                                                                                                                                                                                                                                                                                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0010254B
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: close all
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 469580280-3243417748
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9500e365acf9721b67999433d79a3097f93a0a13ebe1b553606185d80bdef040
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 69568ff0d45a32e05222bfa901ecd9196ce48dd209dfc150f9f58caf9732078f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9500e365acf9721b67999433d79a3097f93a0a13ebe1b553606185d80bdef040
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0ED13B31601212CFCB29EF14C899FADF7A5BF05700F14429DE84A6B292DB71AD16CF94
                                                                                                                                                                                                                                                                                                                                                                          Function 00137DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00137FAD
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00137FC1
                                                                                                                                                                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00137FEB
                                                                                                                                                                                                                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 00138005
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00138017
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00138060
                                                                                                                                                                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 001380B0
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CurrentDirectory$AttributesFile
                                                                                                                                                                                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 769691225-438819550
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 3aa8a67563a28bfec3a95843d664c577d7d17868bcc2e2966dfca9f17ec31fdb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d3cfabf06bea43877c9611cab75aa950619295a45d52e43f727a5da45fda1ec4
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3aa8a67563a28bfec3a95843d664c577d7d17868bcc2e2966dfca9f17ec31fdb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A68180B15083459FCB34EF14C484AAEB3E8BB89310F544C6EF889D7291EB74DD498B52
                                                                                                                                                                                                                                                                                                                                                                          Function 000C5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000EB), ref: 000C5C7A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C5D0A: GetClientRect.USER32(?,?), ref: 000C5D30
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C5D0A: GetWindowRect.USER32(?,?), ref: 000C5D71
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C5D0A: ScreenToClient.USER32(?,?), ref: 000C5D99
                                                                                                                                                                                                                                                                                                                                                                          • GetDC.USER32 ref: 001046F5
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00104708
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 00104716
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0010472B
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 00104733
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 001047C4
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID: U
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4009187628-3372436214
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4bd74b04e1735c21dde96b2305793324002a569f7d5696791369e657fce9907e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ed9c3d65080ecc21a18956f814609104b622abf71877b90327dd0a5af63a33c7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4bd74b04e1735c21dde96b2305793324002a569f7d5696791369e657fce9907e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A971DCB5400205EFCF258F64C9C4AAE3BB1FF4A361F14426AEE955A2A6D3719881DF60
                                                                                                                                                                                                                                                                                                                                                                          Function 0013359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 001335E4
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00192390,?,00000FFF,?), ref: 0013360A
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: LoadString$_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4099089115-2391861430
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 3cf32a8d224621c449c704d7da43d98ca99db6ff6ae664f0b0dcbda6f683f473
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 97258a77b6899eb3afcdadafcdfaf3260ebad47467ced5a418a91b5238550aae
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3cf32a8d224621c449c704d7da43d98ca99db6ff6ae664f0b0dcbda6f683f473
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59518C7190020ABBDF14EBA0DC46EEEBB38EF14310F144129F515721A2EB311B99DFA5
                                                                                                                                                                                                                                                                                                                                                                          Function 00158B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D912D: GetCursorPos.USER32(?), ref: 000D9141
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D912D: ScreenToClient.USER32(00000000,?), ref: 000D915E
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D912D: GetAsyncKeyState.USER32(00000001), ref: 000D9183
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D912D: GetAsyncKeyState.USER32(00000002), ref: 000D919D
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00158B6B
                                                                                                                                                                                                                                                                                                                                                                          • ImageList_EndDrag.COMCTL32 ref: 00158B71
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseCapture.USER32 ref: 00158B77
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowTextW.USER32(?,00000000), ref: 00158C12
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00158C25
                                                                                                                                                                                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00158CFF
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                                                                                                                                                                                                                                                                                                                          • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1924731296-2107944366
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 88e632201ce1a8cf8890aa660c25a012aa0ccea8cc77de2028dd07f7f2723155
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d9b6920e007288b702b2d5205acd091bc07601d3a0e58810d680bf453720384c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 88e632201ce1a8cf8890aa660c25a012aa0ccea8cc77de2028dd07f7f2723155
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 61516B71104304AFD704DF14D856FAE77E4FB88755F400A2DF9666B2E2DB709988CB62
                                                                                                                                                                                                                                                                                                                                                                          Function 0013C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0013C272
                                                                                                                                                                                                                                                                                                                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0013C29A
                                                                                                                                                                                                                                                                                                                                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0013C2CA
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0013C322
                                                                                                                                                                                                                                                                                                                                                                          • SetEvent.KERNEL32(?), ref: 0013C336
                                                                                                                                                                                                                                                                                                                                                                          • InternetCloseHandle.WININET(00000000), ref: 0013C341
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3113390036-3916222277
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: f79b2d60727768b4f87db2701d24218ccc4097968cbfe0bd547a4f1f18c1a9c9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 846196c0a4b16945b09b7f847e2c5e67bb288682ba752bb066b08fb4231971ea
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f79b2d60727768b4f87db2701d24218ccc4097968cbfe0bd547a4f1f18c1a9c9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 273167B1600708AFD7219FA4DC88AAB7BFCFB59744F14851EF486A6600DB30ED459BA1
                                                                                                                                                                                                                                                                                                                                                                          Function 0012989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00103AAF,?,?,Bad directive syntax error,0015CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 001298BC
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000000,?,00103AAF,?), ref: 001298C3
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00129987
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: HandleLoadMessageModuleString_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 858772685-4153970271
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 417703a22943a33b040bdbd1bad8fbadbf98e5bd99b999850c2ebfc99ba43ba7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b52d75b8fb4f9e480e476e349ce8621b6a51e4b50ab61e978a96b90c76079f78
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 417703a22943a33b040bdbd1bad8fbadbf98e5bd99b999850c2ebfc99ba43ba7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 95217A3290031AEBCF15AF90DC4AEEE7739BF18304F04446AF515660A2EB719A68CB60
                                                                                                                                                                                                                                                                                                                                                                          Function 0012209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32 ref: 001220AB
                                                                                                                                                                                                                                                                                                                                                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 001220C0
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0012214D
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClassMessageNameParentSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1290815626-3381328864
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c5d9cda3c2ff0f80a7b91dee083709a3e5694dcf5044125fc412c7498b283899
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 1b0a663158db1bec42ec69730e131653b2be9d2aff3c0a4a2ba5d1fc86c43f36
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c5d9cda3c2ff0f80a7b91dee083709a3e5694dcf5044125fc412c7498b283899
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FC11367A688316BEF7053620FC06CEA379DCF15324B200026FB04B80E2FFB169715A18
                                                                                                                                                                                                                                                                                                                                                                          Function 000F8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0ec8ee899dee97235725bf44d8dcb8f850b44b6e7ac0465fc1b90593e07ca45a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f4620254c9cda82750f10020c4ea78bdfd56a5575b2e9d3cc398cde1e1b3ec0a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ec8ee899dee97235725bf44d8dcb8f850b44b6e7ac0465fc1b90593e07ca45a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 84C1F175A0434DAFCB61DFA9D841BFDBBF0AF09310F044099EA14A7792CB359941EB60
                                                                                                                                                                                                                                                                                                                                                                          Function 000FCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1282221369-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 49fb3fce1d8dd3d4cfccf0082bd8c12ac707508622923e42b5e2ed8f12e18c7f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 096757201bcd504dbe08e805e8524526ce3ad8ea3be0b5c119f375e88a999b69
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 49fb3fce1d8dd3d4cfccf0082bd8c12ac707508622923e42b5e2ed8f12e18c7f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ED61587190430DAFEB21AFB49942ABDBBE5EF05310F04017EFB4597A82DB319E05A790
                                                                                                                                                                                                                                                                                                                                                                          Function 001550D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00155186
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000000), ref: 001551C7
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000005,?,00000000), ref: 001551CD
                                                                                                                                                                                                                                                                                                                                                                          • SetFocus.USER32(?,?,00000005,?,00000000), ref: 001551D1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00156FBA: DeleteObject.GDI32(00000000), ref: 00156FE6
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0015520D
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0015521A
                                                                                                                                                                                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0015524D
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00155287
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00155296
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3210457359-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 1f6a4373d65ae7faadea8daf00e39b5ba6bc2a6ffb65e487bdd970dd852fba1f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2be3f9921045e0ee7d05fa634d7f8eeca7b28cfd13fe4134e44494d41bdaf0e8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1f6a4373d65ae7faadea8daf00e39b5ba6bc2a6ffb65e487bdd970dd852fba1f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7F519330A50A08FEEF249F24CC95BD83BA6EB05366F144012FD359E6E1C775A988DB51
                                                                                                                                                                                                                                                                                                                                                                          Function 000D8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00116890
                                                                                                                                                                                                                                                                                                                                                                          • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 001168A9
                                                                                                                                                                                                                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 001168B9
                                                                                                                                                                                                                                                                                                                                                                          • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 001168D1
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 001168F2
                                                                                                                                                                                                                                                                                                                                                                          • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,000D8874,00000000,00000000,00000000,000000FF,00000000), ref: 00116901
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0011691E
                                                                                                                                                                                                                                                                                                                                                                          • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,000D8874,00000000,00000000,00000000,000000FF,00000000), ref: 0011692D
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1268354404-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: df8e03b2a282dd3cbc9a2629144c1a87732eb658ef22cce2bd744cb5aab1db4c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 05a86f7bd44232ac5bda3e038f24a77ce8073ae15134c40ea2819405fedb60e2
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: df8e03b2a282dd3cbc9a2629144c1a87732eb658ef22cce2bd744cb5aab1db4c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CD51AD70600309EFDB24CF24CC95FAA7BB5FB58365F10452AF9129B2A0DB71E990DB60
                                                                                                                                                                                                                                                                                                                                                                          Function 0013C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0013C182
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0013C195
                                                                                                                                                                                                                                                                                                                                                                          • SetEvent.KERNEL32(?), ref: 0013C1A9
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0013C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0013C272
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0013C253: GetLastError.KERNEL32 ref: 0013C322
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0013C253: SetEvent.KERNEL32(?), ref: 0013C336
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0013C253: InternetCloseHandle.WININET(00000000), ref: 0013C341
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 337547030-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e92734f7963f5c3ee264b2a13b4f0023b1ac7c63df8147b1bb7e6666b3d9fde0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 91cd3892d9de3af1224d18c596258b5aa7596f2fe483bc1b95dca5771195e1d3
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e92734f7963f5c3ee264b2a13b4f0023b1ac7c63df8147b1bb7e6666b3d9fde0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DD315571200705EFDB219FA5DC44A6BBBE9FF28301F04442DF956AAA10D730E854ABE0
                                                                                                                                                                                                                                                                                                                                                                          Function 001225A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00123A57
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: GetCurrentThreadId.KERNEL32 ref: 00123A5E
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001225B3), ref: 00123A65
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 001225BD
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 001225DB
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 001225DF
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 001225E9
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00122601
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00122605
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 0012260F
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00122623
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00122627
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2014098862-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c063b1bfe7626b3168496e279a520b2bb8aa5c3fcbd659550e495a7a0f875562
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5238e2bbca56fa7482d1b51a506223c2399eed1995a5425b821074dc0de9b0de
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c063b1bfe7626b3168496e279a520b2bb8aa5c3fcbd659550e495a7a0f875562
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F301D831390720FBFB106B689CCAF993F99DB5EB12F100011F314AF1D1CAF114948AA9
                                                                                                                                                                                                                                                                                                                                                                          Function 00121803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00121449,?,?,00000000), ref: 0012180C
                                                                                                                                                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(00000000,?,00121449,?,?,00000000), ref: 00121813
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00121449,?,?,00000000), ref: 00121828
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,00121449,?,?,00000000), ref: 00121830
                                                                                                                                                                                                                                                                                                                                                                          • DuplicateHandle.KERNEL32(00000000,?,00121449,?,?,00000000), ref: 00121833
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00121449,?,?,00000000), ref: 00121843
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00121449,00000000,?,00121449,?,?,00000000), ref: 0012184B
                                                                                                                                                                                                                                                                                                                                                                          • DuplicateHandle.KERNEL32(00000000,?,00121449,?,?,00000000), ref: 0012184E
                                                                                                                                                                                                                                                                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,00121874,00000000,00000000,00000000), ref: 00121868
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1957940570-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 25717365dbf7c1601a03762abf0a4181ec91d930a971a04beac4b5bf82f0651b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f4f62a5016e28510474150d323d7d553f30869cbc9a08aca43b4ff09b47cb344
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 25717365dbf7c1601a03762abf0a4181ec91d930a971a04beac4b5bf82f0651b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6101A8B5640708FFE610AFA5DC89F6B3BACEB89B11F004411FA05DB5A1CA709850CB60
                                                                                                                                                                                                                                                                                                                                                                          Function 0014A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0012D501
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0012D50F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012D4DC: CloseHandle.KERNELBASE(00000000), ref: 0012D5DC
                                                                                                                                                                                                                                                                                                                                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0014A16D
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0014A180
                                                                                                                                                                                                                                                                                                                                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0014A1B3
                                                                                                                                                                                                                                                                                                                                                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 0014A268
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(00000000), ref: 0014A273
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 0014A2C4
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                                                                                                                                                                                                                                                                                                                          • String ID: SeDebugPrivilege
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2533919879-2896544425
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d086de7a9286c251348ab5f234a8d89b468551c1b61e08ccf75e47aaaff5581b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 1991ec38b69463bdb303b94b8df2ed44868bb0e79c72d88fbd54574294b1d95a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d086de7a9286c251348ab5f234a8d89b468551c1b61e08ccf75e47aaaff5581b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EF61A1302442429FD720DF14C494F5ABBE1AF54318F55849CE45A4FBA3C7B2ED46DB92
                                                                                                                                                                                                                                                                                                                                                                          Function 00153886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00153925
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0015393A
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00153954
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00153999
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 001539C6
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001061,?,0000000F), ref: 001539F4
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$Window_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: SysListView32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2147712094-78025650
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0d2d96f27d0f82b0ef350d357f893c2f1667ff1ac025cef0f65e3cac37043045
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3a6734ca8262f1d2ed308ce464a18402a90e447581a6f4bbd291f97a8967ccf7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0d2d96f27d0f82b0ef350d357f893c2f1667ff1ac025cef0f65e3cac37043045
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9E417571A00319EFEF259F64CC49BEA77A9EF08395F100526F964EB281D7719A84CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 0012BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0012BCFD
                                                                                                                                                                                                                                                                                                                                                                          • IsMenu.USER32(00000000), ref: 0012BD1D
                                                                                                                                                                                                                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 0012BD53
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemCount.USER32(015B5910), ref: 0012BDA4
                                                                                                                                                                                                                                                                                                                                                                          • InsertMenuItemW.USER32(015B5910,?,00000001,00000030), ref: 0012BDCC
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0$2
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 93392585-3793063076
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5d756c6dc87960146e066497a85d9ef1b239bf75c9ecfb182502c871ed741ec9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 358162839800437becc528399c11af99555505faf420b107be65c636df597a3c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5d756c6dc87960146e066497a85d9ef1b239bf75c9ecfb182502c871ed741ec9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6751BE70A08329DBDB14CFE8E8C4BEEBBF4AF55318F148119E4519B291E7709961CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 0012C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadIconW.USER32(00000000,00007F03), ref: 0012C913
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: IconLoad
                                                                                                                                                                                                                                                                                                                                                                          • String ID: blank$info$question$stop$warning
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2457776203-404129466
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8538c6b751da78a53ab26b6986da8a43e8126dd480e837a77e403de60b234f5b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 778f995ddd844a5860f66f27ba50125c1bda71767bbf062825a6b27a47645c7d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8538c6b751da78a53ab26b6986da8a43e8126dd480e837a77e403de60b234f5b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2112B31689316BEEB046B54EC83CEE379CDF15328B10003EF700A6182E7E05E5057E9
                                                                                                                                                                                                                                                                                                                                                                          Function 0012DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0.0.0.0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 642191829-3771769585
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7875395cfa02283330e59209716e24040bafebce7719ba31757930a90ace759a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 47812cca35bcafcb028ed85f54bf3c3a7e9909d4bf1d161a0f6da0069eb46505
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7875395cfa02283330e59209716e24040bafebce7719ba31757930a90ace759a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33110A71504315AFDB24AF60FC0ADEE77ACDF15711F020169F445AA092EF718AC18AA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00159F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          • GetSystemMetrics.USER32(0000000F), ref: 00159FC7
                                                                                                                                                                                                                                                                                                                                                                          • GetSystemMetrics.USER32(0000000F), ref: 00159FE7
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0015A224
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0015A242
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0015A263
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(00000003,00000000), ref: 0015A282
                                                                                                                                                                                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0015A2A7
                                                                                                                                                                                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000005,?,?), ref: 0015A2CA
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1211466189-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8993da2a4a8f90d757042bf1ae5c32c575604b73d5b086cb06960c1ed53ad50b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 637c69a3dfb25ca08ca48080eb6e50d06af7ce28b39e136525cd768b43203a01
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8993da2a4a8f90d757042bf1ae5c32c575604b73d5b086cb06960c1ed53ad50b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 15B1B931640219EFCF14CF68C9C57AA3BB2BF48702F488169ECA59F295D731A984CB51
                                                                                                                                                                                                                                                                                                                                                                          Function 0012ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$LocalTime
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 952045576-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 603063719d66416ba8c44ac90524bf28eea8685f6f07173cef914686b8cffd58
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 963cfaae5ed4a3639e7813f67bf5cb50e9ddf7933afac642a05a5ed9a44d2e86
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 603063719d66416ba8c44ac90524bf28eea8685f6f07173cef914686b8cffd58
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC41A065C1026879CB11EBF5988A9CFB7A8AF45310F518466E618F3123FB34E255C3E6
                                                                                                                                                                                                                                                                                                                                                                          Function 000DF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0011682C,00000004,00000000,00000000), ref: 000DF953
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0011682C,00000004,00000000,00000000), ref: 0011F3D1
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0011682C,00000004,00000000,00000000), ref: 0011F454
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ShowWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1268545403-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b799a95c609f48f6772fb42368679f9a777a42b9a793b1cff0db28c97ff0908f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 93c2a7e17507d82b741b8280daab1e168e4b731a529cda5cafac9e8a7e8d58e1
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b799a95c609f48f6772fb42368679f9a777a42b9a793b1cff0db28c97ff0908f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BB410830A18782BEC7799F2988A877ABAD2BB56314F14C03EE05796B61D73198C1C771
                                                                                                                                                                                                                                                                                                                                                                          Function 00152D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00152D1B
                                                                                                                                                                                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 00152D23
                                                                                                                                                                                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00152D2E
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00152D3A
                                                                                                                                                                                                                                                                                                                                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00152D76
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00152D87
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00155A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00152DC2
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00152DE1
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3864802216-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5f648900b2d9542f8eb0846feadb6ffa097d7874e65c8ac19d021933f44189f2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 13a4eb7a97b2d39ffd6d2766b3332759e6cca400fe7f9219a6cc118c5c7b05bc
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f648900b2d9542f8eb0846feadb6ffa097d7874e65c8ac19d021933f44189f2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BA316B76201314BFEB118F50DC8AFEB3BA9EB0A716F044055FE089E291C6759C90CBA4
                                                                                                                                                                                                                                                                                                                                                                          Function 00125622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _memcmp
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2931989736-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 252e04f149c8be5bfdd42ded95327a202b5cb28326f7fef45b61312b40e6e601
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8e50aa856a7f87f65c8d821ebcbad64cd829a5eb0e8da2db773df015ada695c9
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 252e04f149c8be5bfdd42ded95327a202b5cb28326f7fef45b61312b40e6e601
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8D21C571A41A69BFD3189521AEC2FFB335EAF60385F440034FD04AA582F770EE2581A5
                                                                                                                                                                                                                                                                                                                                                                          Function 00144FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID: NULL Pointer assignment$Not an Object type
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 0-572801152
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 338a4dd03c0e65eacb8422dd476dededc6fa5e0da16b1131c223601dbd0dc894
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 161d618f11385ace130256a57af93d08e949ca7e86c034dfb39ef538a4240264
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 338a4dd03c0e65eacb8422dd476dededc6fa5e0da16b1131c223601dbd0dc894
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7CD1B175A0060AAFDF14CFA8C881FAEB7B6BF48344F148169F915AB292D770DD45CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00101522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,001017FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 001015CE
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,001017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00101651
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,001017FB,?,001017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 001016E4
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,001017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 001016FB
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F3820: RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,001017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00101777
                                                                                                                                                                                                                                                                                                                                                                          • __freea.LIBCMT ref: 001017A2
                                                                                                                                                                                                                                                                                                                                                                          • __freea.LIBCMT ref: 001017AE
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2829977744-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 90bfda338b1ba8e6eaa45d6083ba38386e030a2d4301080a893419cf339ac5a6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f8be285625cee7443e95183db45a9465af8db08009a14df5df5d36f5144d9a75
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 90bfda338b1ba8e6eaa45d6083ba38386e030a2d4301080a893419cf339ac5a6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8391B872E00216BEDB248EB4CC81AFE7BB5AF49710F184659E941EB1C1DBB9DD40CB60
                                                                                                                                                                                                                                                                                                                                                                          Function 00144523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Variant$ClearInit
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2610073882-625585964
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4a81dac0fd2adc768d5a70844392b60b01237185b52b7471817779cd2bd692b6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ec64ac9a27f8e10f4ca013c4686039c73c99d06a22362a9447157b3e7a5b21ed
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4a81dac0fd2adc768d5a70844392b60b01237185b52b7471817779cd2bd692b6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9C91AC71A00219EFDF24CFA4C888FAEBBB8EF46715F108559F515AB291D7709942CFA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00131187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0013125C
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00131284
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 001312A8
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 001312D8
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0013135F
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 001313C4
                                                                                                                                                                                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00131430
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2550207440-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e03f07e99b2745e49016166a7c23cea1dd062738981aff7103e07adbfd92cfc0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6a86d7165b7cd48fc157f423cb8ae9082e80987363798c1e62f61fbfdbe9b6fc
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e03f07e99b2745e49016166a7c23cea1dd062738981aff7103e07adbfd92cfc0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8991F472A00309AFEB00DFA4C894BFEB7B5FF44325F214029E911EB292D774A941CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 000D948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ObjectSelect$BeginCreatePath
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3225163088-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 58c9497992c06d74d0e1b9618d40dd3a3376b85374c1c8acdd62b8e597798724
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a0a61dfe4b63d4b5cff9ce9aed77343e10b9d2119dc72a63d0b34f243fd8ffac
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 58c9497992c06d74d0e1b9618d40dd3a3376b85374c1c8acdd62b8e597798724
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9911571900219EFCB15CFA9C884AEEBBB8FF49320F144556E515B7295D374AA82CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00143947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 0014396B
                                                                                                                                                                                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,?), ref: 00143A7A
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00143A8A
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00143C1F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00130CDF: VariantInit.OLEAUT32(00000000), ref: 00130D1F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00130CDF: VariantCopy.OLEAUT32(?,?), ref: 00130D28
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00130CDF: VariantClear.OLEAUT32(?), ref: 00130D34
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4137639002-1221869570
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: ab5ebf279916ea63ba4ebdf3e6bfb86f9b80b0388ff5a6a3963f9db870acc4e0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a5eeabbf296c99287b7b7f102e4a67b3c506a2c4bbbdad69c5b7c0342d22ff80
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ab5ebf279916ea63ba4ebdf3e6bfb86f9b80b0388ff5a6a3963f9db870acc4e0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C59149756083059FC704EF24C48596AB7E5FF89314F14892EF89A9B362DB30EE45CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 00144BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?,?,0012035E), ref: 0012002B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120046
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120054
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?), ref: 00120064
                                                                                                                                                                                                                                                                                                                                                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00144C51
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00144D59
                                                                                                                                                                                                                                                                                                                                                                          • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00144DCF
                                                                                                                                                                                                                                                                                                                                                                          • CoTaskMemFree.OLE32(?), ref: 00144DDA
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                                                                                                                                                                                                                                                                                                                                          • String ID: NULL Pointer assignment
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 614568839-2785691316
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 124258f990786b5006f0789320414b35a9d1bd627235b333dd6d02f767384380
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: baa187ed3fcc7da20255eaa633f5c4631003cac80c956213d8170fe21f57eca3
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 124258f990786b5006f0789320414b35a9d1bd627235b333dd6d02f767384380
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D910471D0021DAFDF14DFA4D891EEEB7B9BF08314F108169E915BB291EB349A458FA0
                                                                                                                                                                                                                                                                                                                                                                          Function 001520FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetMenu.USER32(?), ref: 00152183
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemCount.USER32(00000000), ref: 001521B5
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 001521DD
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00152213
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemID.USER32(?,?), ref: 0015224D
                                                                                                                                                                                                                                                                                                                                                                          • GetSubMenu.USER32(?,?), ref: 0015225B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00123A57
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: GetCurrentThreadId.KERNEL32 ref: 00123A5E
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001225B3), ref: 00123A65
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 001522E3
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012E97B: Sleep.KERNEL32 ref: 0012E9F3
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4196846111-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: ee24f7b9ca851f782bc7107e8d30ccd6fe622eb1af9d2baa57dd838cb6e003f2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 936fcd5311247ee3161152232bd2fca4a8e1c0ca32aefea7a3efc42b8a3b7d82
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ee24f7b9ca851f782bc7107e8d30ccd6fe622eb1af9d2baa57dd838cb6e003f2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E8718176A00205EFCB14DF64C885AAEB7F1EF49311F158469E826EF341D774EE458B90
                                                                                                                                                                                                                                                                                                                                                                          Function 00157E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • IsWindow.USER32(015B5B18), ref: 00157F37
                                                                                                                                                                                                                                                                                                                                                                          • IsWindowEnabled.USER32(015B5B18), ref: 00157F43
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0015801E
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(015B5B18,000000B0,?,?), ref: 00158051
                                                                                                                                                                                                                                                                                                                                                                          • IsDlgButtonChecked.USER32(?,?), ref: 00158089
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(015B5B18,000000EC), ref: 001580AB
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 001580C3
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4072528602-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e53bc1c8cb7f769d0be4e42132c1565f2a2bfcbca801c2d996879b04ccea881e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b8aee364c35e89f2ae94ea237e0ef80fcf8f08cd9c715499b7eeec704f03b503
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e53bc1c8cb7f769d0be4e42132c1565f2a2bfcbca801c2d996879b04ccea881e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C7718D34608204EFEB21DF54D886FEA7BB5EF09302F14045AFD759B2A1CB31A988CB50
                                                                                                                                                                                                                                                                                                                                                                          Function 0012AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32(?), ref: 0012AEF9
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyboardState.USER32(?), ref: 0012AF0E
                                                                                                                                                                                                                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 0012AF6F
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000010,?), ref: 0012AF9D
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000011,?), ref: 0012AFBC
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000012,?), ref: 0012AFFD
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,0000005B,?), ref: 0012B020
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 87235514-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 044b760c130b1c9da1712c7539e926b8e23d7212e9389633e10eba8a27f3057f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 668bd037bc214fadaef956dffbe724aedf795881648c6070fc9e3d064966e660
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044b760c130b1c9da1712c7539e926b8e23d7212e9389633e10eba8a27f3057f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B851D3A06087E53EFB3742349D45BBABFE95F06304F088589F2E9958C2D398ACE4D751
                                                                                                                                                                                                                                                                                                                                                                          Function 0012ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetParent.USER32(00000000), ref: 0012AD19
                                                                                                                                                                                                                                                                                                                                                                          • GetKeyboardState.USER32(?), ref: 0012AD2E
                                                                                                                                                                                                                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 0012AD8F
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0012ADBB
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0012ADD8
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0012AE17
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0012AE38
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 87235514-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 46ebf31b50f712d5d1d69f6fd54b83ef699b6b92f14308f65cb557dcfc7f527c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2690a2b1d71472dd989c9426b568d13c8089910add7ab7ee1289065eb8ffeb28
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 46ebf31b50f712d5d1d69f6fd54b83ef699b6b92f14308f65cb557dcfc7f527c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 865116A05087E53EFB3683749C95B7ABEA85F05300F488488E1D5468C3D394ECA4D352
                                                                                                                                                                                                                                                                                                                                                                          Function 000F542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetConsoleCP.KERNEL32(00103CD6,?,?,?,?,?,?,?,?,000F5BA3,?,?,00103CD6,?,?), ref: 000F5470
                                                                                                                                                                                                                                                                                                                                                                          • __fassign.LIBCMT ref: 000F54EB
                                                                                                                                                                                                                                                                                                                                                                          • __fassign.LIBCMT ref: 000F5506
                                                                                                                                                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00103CD6,00000005,00000000,00000000), ref: 000F552C
                                                                                                                                                                                                                                                                                                                                                                          • WriteFile.KERNEL32(?,00103CD6,00000000,000F5BA3,00000000,?,?,?,?,?,?,?,?,?,000F5BA3,?), ref: 000F554B
                                                                                                                                                                                                                                                                                                                                                                          • WriteFile.KERNEL32(?,?,00000001,000F5BA3,00000000,?,?,?,?,?,?,?,?,?,000F5BA3,?), ref: 000F5584
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1324828854-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 78e7a72796f5a7db176ed3f702ec89f072a77de78797331b14a0c5eafc5c19a8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3048e01e5ca1c9f96a3417db456f294170786604d621d840916531a00690361f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 78e7a72796f5a7db176ed3f702ec89f072a77de78797331b14a0c5eafc5c19a8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE51D171A00B099FDB11CFA8DC95AEEBBF9EF08701F14411AF655E7691D730AA41CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000E2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _ValidateLocalCookies.LIBCMT ref: 000E2D4B
                                                                                                                                                                                                                                                                                                                                                                          • ___except_validate_context_record.LIBVCRUNTIME ref: 000E2D53
                                                                                                                                                                                                                                                                                                                                                                          • _ValidateLocalCookies.LIBCMT ref: 000E2DE1
                                                                                                                                                                                                                                                                                                                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 000E2E0C
                                                                                                                                                                                                                                                                                                                                                                          • _ValidateLocalCookies.LIBCMT ref: 000E2E61
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1170836740-1018135373
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 1b96fd6f2f419f7aa969869e582ae4f19208ffd7e4cd15e9d371f172b1570e76
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: af7009df11dc28df686a8fba2a795a7f3e8c3dd7d002afd457df0cd797841db5
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b96fd6f2f419f7aa969869e582ae4f19208ffd7e4cd15e9d371f172b1570e76
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6341A035A04289AFCF10DF6ACC45ADEBBB9BF44324F148155E914BB392D771AA41CBD0
                                                                                                                                                                                                                                                                                                                                                                          Function 001410B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0014307A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014304E: _wcslen.LIBCMT ref: 0014309B
                                                                                                                                                                                                                                                                                                                                                                          • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00141112
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 00141121
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 001411C9
                                                                                                                                                                                                                                                                                                                                                                          • closesocket.WSOCK32(00000000), ref: 001411F9
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2675159561-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5eb964c868e7ef4b44d24d99f227c9f7ccecbd4d4730c02141b6f6391b0d1d44
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6c596987b9b1539883a633ba33ec0d8346ffacdf1924ff8921597c5026ee1ae4
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5eb964c868e7ef4b44d24d99f227c9f7ccecbd4d4730c02141b6f6391b0d1d44
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E741D431600604AFDB109F24C885BA9BBE9EF45765F148069FD199F2A2D770AD81CBE1
                                                                                                                                                                                                                                                                                                                                                                          Function 0012CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0012CF22,?), ref: 0012DDFD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0012CF22,?), ref: 0012DE16
                                                                                                                                                                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0012CF45
                                                                                                                                                                                                                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0012CF7F
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012D005
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012D01B
                                                                                                                                                                                                                                                                                                                                                                          • SHFileOperationW.SHELL32(?), ref: 0012D061
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                                                                                                                                                                                                                                                                                                                                          • String ID: \*.*
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3164238972-1173974218
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d3057fc7fad48b6a545a4907b12d3bdd02214f6bf0fb4aaa5ed399fd81330b19
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a9dc0f05ac89c7189675b353ac249182715ddd9c877ba556f4baff35c5a5ac70
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d3057fc7fad48b6a545a4907b12d3bdd02214f6bf0fb4aaa5ed399fd81330b19
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 154139719452299FDF12EFA4EA81EDD77F9AF18340F1000E6E645EB142EB34A794CB50
                                                                                                                                                                                                                                                                                                                                                                          Function 00152DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00152E1C
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00152E4F
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00152E84
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00152EB6
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00152EE0
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00152EF1
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00152F0B
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: LongWindow$MessageSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2178440468-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6f7c54423381fd2a4aa3785af95d3c23092b04b54e0cfdb9fcddc9cb364c9ad1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cb3d0e8f9bf0489908b66315e480422ab10c483ba5b40510b4002791d308e958
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f7c54423381fd2a4aa3785af95d3c23092b04b54e0cfdb9fcddc9cb364c9ad1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3310332604251EFDB21CF58EC86FA537E1EB9A716F150165F9208F6B1CB71A884DB41
                                                                                                                                                                                                                                                                                                                                                                          Function 00127726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00127769
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0012778F
                                                                                                                                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32(00000000), ref: 00127792
                                                                                                                                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32(?), ref: 001277B0
                                                                                                                                                                                                                                                                                                                                                                          • SysFreeString.OLEAUT32(?), ref: 001277B9
                                                                                                                                                                                                                                                                                                                                                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 001277DE
                                                                                                                                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32(?), ref: 001277EC
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3761583154-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e341768e34ddcc80e901e2ad73ea2bba67093b7f574b22a13ae31a2cf71542fe
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4ddc2cfd5814d5ee38cedaf068ddf658eb88066009213ccb1234a5616badc4ba
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e341768e34ddcc80e901e2ad73ea2bba67093b7f574b22a13ae31a2cf71542fe
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37219076604329AFDB10EFA8DC88CBB77ACEB097647048425FA15DB291D770DC8187A0
                                                                                                                                                                                                                                                                                                                                                                          Function 001277FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00127842
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00127868
                                                                                                                                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32(00000000), ref: 0012786B
                                                                                                                                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32 ref: 0012788C
                                                                                                                                                                                                                                                                                                                                                                          • SysFreeString.OLEAUT32 ref: 00127895
                                                                                                                                                                                                                                                                                                                                                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 001278AF
                                                                                                                                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32(?), ref: 001278BD
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3761583154-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 50aa42640d269ff920a97247d416209da0a94c1c06e759fb71a75104b80ceceb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f2ac9fa84040c262c73329a76ec2b18a8b094b4640c963bbdcdd0ddd77bc8c56
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 50aa42640d269ff920a97247d416209da0a94c1c06e759fb71a75104b80ceceb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 17215E35608324EF9B149FA9EC88DBB77ECEB097607108125B915CB2A1EB70DC91CB64
                                                                                                                                                                                                                                                                                                                                                                          Function 001304D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetStdHandle.KERNEL32(0000000C), ref: 001304F2
                                                                                                                                                                                                                                                                                                                                                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0013052E
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CreateHandlePipe
                                                                                                                                                                                                                                                                                                                                                                          • String ID: nul
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1424370930-2873401336
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 26faac6b26199f791f29c9d8a9e43665b73130be0b16de393a48e719232af554
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a29fdd237d1c634576f10ba25353e571f5e09643214323a0854b3d1db24c47bf
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 26faac6b26199f791f29c9d8a9e43665b73130be0b16de393a48e719232af554
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A3216975600305EFDB219F29DC54A9A7BE4BF49724F204A19F8A1E72E0E7709980CF60
                                                                                                                                                                                                                                                                                                                                                                          Function 001305A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetStdHandle.KERNEL32(000000F6), ref: 001305C6
                                                                                                                                                                                                                                                                                                                                                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00130601
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CreateHandlePipe
                                                                                                                                                                                                                                                                                                                                                                          • String ID: nul
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1424370930-2873401336
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 229484b413e76c7b237600f3efc7b1344ec7a4393b7a41b3b59423d1f7bb0d51
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 155ae74feca98e453800ce45ff7101bff5b3f2ddf1ec756d9bc72578fef147db
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 229484b413e76c7b237600f3efc7b1344ec7a4393b7a41b3b59423d1f7bb0d51
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E21B6B5500305DFDB219F69CC55A9A77E8BF99B30F200B19F8A1E72E4E77099A0CB50
                                                                                                                                                                                                                                                                                                                                                                          Function 001540AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000C604C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C600E: GetStockObject.GDI32(00000011), ref: 000C6060
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 000C606A
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00154112
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0015411F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0015412A
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00154139
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00154145
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Msctls_Progress32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1025951953-3636473452
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 44b9338130ac7a3dad3041d40d04b5be3ff0d407451e54c7182dbd6684c95f1d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7fa1a342841da37fea852ef565ae46693d5c9ecf4c18ad3c6412427958ec7553
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 44b9338130ac7a3dad3041d40d04b5be3ff0d407451e54c7182dbd6684c95f1d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8711B2B2140219BFEF119F64CC85EE77F9DEF18798F114111BA28A6190C772DC61DBA4
                                                                                                                                                                                                                                                                                                                                                                          Function 000FD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000FD7A3: _free.LIBCMT ref: 000FD7CC
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD82D
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: HeapFree.KERNEL32(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD838
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD843
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD897
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD8A2
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD8AD
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD8B8
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 776569668-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cd737ba26dfaf364654ed884dac576c2ddce0bbd380adf366fd1631b6ff96c75
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B11247158470CAAD521BFB0CC47FEF7BDD6F04700F404816B399AA8A3EA69B5056650
                                                                                                                                                                                                                                                                                                                                                                          Function 0012DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0012DA74
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000000), ref: 0012DA7B
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0012DA91
                                                                                                                                                                                                                                                                                                                                                                          • LoadStringW.USER32(00000000), ref: 0012DA98
                                                                                                                                                                                                                                                                                                                                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0012DADC
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          • %s (%d) : ==> %s: %s %s, xrefs: 0012DAB9
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: HandleLoadModuleString$Message
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %s (%d) : ==> %s: %s %s
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4072794657-3128320259
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: acc24c99aee3ace133152996904fa33267099c1f2d02d06dce9d6a52beb15937
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 78eb0b45c965ffbe37c210bee044b665fd8401d8b5230c93d391a7c72cebb541
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: acc24c99aee3ace133152996904fa33267099c1f2d02d06dce9d6a52beb15937
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 170162F6500318BFE710ABA4ED89EEB326CE708306F404491B706E6041EA749E848FB4
                                                                                                                                                                                                                                                                                                                                                                          Function 0013096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(015AEEF8,015AEEF8), ref: 0013097B
                                                                                                                                                                                                                                                                                                                                                                          • EnterCriticalSection.KERNEL32(015AEED8,00000000), ref: 0013098D
                                                                                                                                                                                                                                                                                                                                                                          • TerminateThread.KERNEL32(?,000001F6), ref: 0013099B
                                                                                                                                                                                                                                                                                                                                                                          • WaitForSingleObject.KERNEL32(?,000003E8), ref: 001309A9
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 001309B8
                                                                                                                                                                                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(015AEEF8,000001F6), ref: 001309C8
                                                                                                                                                                                                                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(015AEED8), ref: 001309CF
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3495660284-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 3983d6e2fac9bc02f441799608a172fcc5c024d38e4ee20712033a7c805944e4
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 43c5c5f7abc80535bf27e359d93da0cd1bce38b4868b5938310de4cf3721ecae
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3983d6e2fac9bc02f441799608a172fcc5c024d38e4ee20712033a7c805944e4
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2AF0CD31442B12EFD7525F94EE89BDA7A65FF05706F401015F10258CA1CB7594A5CFD0
                                                                                                                                                                                                                                                                                                                                                                          Function 00141C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00141DC0
                                                                                                                                                                                                                                                                                                                                                                          • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00141DE1
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 00141DF2
                                                                                                                                                                                                                                                                                                                                                                          • htons.WSOCK32(?,?,?,?,?), ref: 00141EDB
                                                                                                                                                                                                                                                                                                                                                                          • inet_ntoa.WSOCK32(?), ref: 00141E8C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 001239E8: _strlen.LIBCMT ref: 001239F2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00143224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0013EC0C), ref: 00143240
                                                                                                                                                                                                                                                                                                                                                                          • _strlen.LIBCMT ref: 00141F35
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3203458085-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 56365556189ed0f33821f70fb8428da312d87d0fec1c5b9918777df0964b4279
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cbd6dc7f555b5a915e67b9d0b6c82afc9ab13416b652a2b1cd94d2045a0abd26
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 56365556189ed0f33821f70fb8428da312d87d0fec1c5b9918777df0964b4279
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFB1DD71604340AFC324DF24C895F6A7BA5AF84318F94895CF45A5B2E3DB31ED8ACB91
                                                                                                                                                                                                                                                                                                                                                                          Function 000C5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 000C5D30
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 000C5D71
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 000C5D99
                                                                                                                                                                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 000C5ED7
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 000C5EF8
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Rect$Client$Window$Screen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1296646539-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: bf33e4a210cfdc4ee52079a21212455f98a967e19b1b1d5bd6d4ee396daa081c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e54b078a6e1da10e557f958f70b922ac0471bb1e978b059a782feb0031d4abfa
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bf33e4a210cfdc4ee52079a21212455f98a967e19b1b1d5bd6d4ee396daa081c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7BB14C78A0074ADBDB14CFA9C880BEEB7F1BF58311F14841EE999D7250D730AA91DB54
                                                                                                                                                                                                                                                                                                                                                                          Function 000F01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • __allrem.LIBCMT ref: 000F00BA
                                                                                                                                                                                                                                                                                                                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000F00D6
                                                                                                                                                                                                                                                                                                                                                                          • __allrem.LIBCMT ref: 000F00ED
                                                                                                                                                                                                                                                                                                                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000F010B
                                                                                                                                                                                                                                                                                                                                                                          • __allrem.LIBCMT ref: 000F0122
                                                                                                                                                                                                                                                                                                                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000F0140
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1992179935-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 867f9c68ce14ac78fe5e4b8ed0ad9f3a007cfcac25d1ab3ecb33374e853bd332
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C811972600B0AAFE7209F69CC41BBB73E9AF41724F24453EF651D7A82EB75D9009B50
                                                                                                                                                                                                                                                                                                                                                                          Function 000F61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,000E82D9,000E82D9,?,?,?,000F644F,00000001,00000001,8BE85006), ref: 000F6258
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,000F644F,00000001,00000001,8BE85006,?,?,?), ref: 000F62DE
                                                                                                                                                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 000F63D8
                                                                                                                                                                                                                                                                                                                                                                          • __freea.LIBCMT ref: 000F63E5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F3820: RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852
                                                                                                                                                                                                                                                                                                                                                                          • __freea.LIBCMT ref: 000F63EE
                                                                                                                                                                                                                                                                                                                                                                          • __freea.LIBCMT ref: 000F6413
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1414292761-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: f28c1c16d1ff3ba0e72b006e36294361971dc75b40992cb30a268b959ef837d3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 468905e7c5e34dc74cddaeb9976564366b4f5e20deeaf729453268d612ed4288
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f28c1c16d1ff3ba0e72b006e36294361971dc75b40992cb30a268b959ef837d3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 76512172A0021AAFEB258F64CC81EBF77AAEF50750F144228FE05D7941DB36DD44E6A0
                                                                                                                                                                                                                                                                                                                                                                          Function 0014BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014C9F1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA68
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA9E
                                                                                                                                                                                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014BCCA
                                                                                                                                                                                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0014BD25
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0014BD6A
                                                                                                                                                                                                                                                                                                                                                                          • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0014BD99
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0014BDF3
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 0014BDFF
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1120388591-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: f6b4a46fe152483351a31d971b6daa7d84d6880ab1a6959d1aa9e85660b36b9a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 93b73353a5ad5b78578e5b75113ca385663f30635170631e707224cc9d04f98f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f6b4a46fe152483351a31d971b6daa7d84d6880ab1a6959d1aa9e85660b36b9a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6E815870608241AFD714DF64C8D5E6ABBE5FF84308F14899CF4598B2A2DB32ED45CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 0011F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(00000035), ref: 0011F7B9
                                                                                                                                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32(00000001), ref: 0011F860
                                                                                                                                                                                                                                                                                                                                                                          • VariantCopy.OLEAUT32(0011FA64,00000000), ref: 0011F889
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(0011FA64), ref: 0011F8AD
                                                                                                                                                                                                                                                                                                                                                                          • VariantCopy.OLEAUT32(0011FA64,00000000), ref: 0011F8B1
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 0011F8BB
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Variant$ClearCopy$AllocInitString
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3859894641-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 366ee587ed9b28c8adea1472248d95a6a08d25e93b8650fe8922fef356d80eec
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2992341bb49fbbb7f6dca69eea46391a9ace7a0f05503d457158162ceb60f2be
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 366ee587ed9b28c8adea1472248d95a6a08d25e93b8650fe8922fef356d80eec
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7251D531500314BACF18AF65D895BA9B3A5EF55314F24847FF806DF292DB708C85CBA6
                                                                                                                                                                                                                                                                                                                                                                          Function 0013910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A
                                                                                                                                                                                                                                                                                                                                                                          • GetOpenFileNameW.COMDLG32(00000058), ref: 001394E5
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00139506
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0013952D
                                                                                                                                                                                                                                                                                                                                                                          • GetSaveFileNameW.COMDLG32(00000058), ref: 00139585
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$FileName$OpenSave
                                                                                                                                                                                                                                                                                                                                                                          • String ID: X
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 83654149-3081909835
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: bc139fe0ab4e04b4cf13138f1955fcef12a706123b2ab77880e692606d1136c2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0547a395e86a7e0e2b814b578077bf1b9d020eb49b106e16dfb5cd973466fecb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bc139fe0ab4e04b4cf13138f1955fcef12a706123b2ab77880e692606d1136c2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3E16B716083409FD724EF24C885BAEB7E4BF85314F04896DF8899B2A2DB71DD45CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 000D920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          • BeginPaint.USER32(?,?,?), ref: 000D9241
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 000D92A5
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 000D92C2
                                                                                                                                                                                                                                                                                                                                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 000D92D3
                                                                                                                                                                                                                                                                                                                                                                          • EndPaint.USER32(?,?,?,?,?), ref: 000D9321
                                                                                                                                                                                                                                                                                                                                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 001171EA
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9339: BeginPath.GDI32(00000000), ref: 000D9357
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3050599898-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c0dde96bb26a5ab6da80b49bb6d34a42260cc9956b43bde0c08b2060d6a9af77
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: fe58bf18ef468a28c720816b4975a0ba12778f7b0172ea05f48cfa81f726611f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c0dde96bb26a5ab6da80b49bb6d34a42260cc9956b43bde0c08b2060d6a9af77
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 75419A70108301EFD721DF24CC84FBA7BB8EB59725F14062AF9A59B2E2C7319985DB61
                                                                                                                                                                                                                                                                                                                                                                          Function 001307EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 0013080C
                                                                                                                                                                                                                                                                                                                                                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00130847
                                                                                                                                                                                                                                                                                                                                                                          • EnterCriticalSection.KERNEL32(?), ref: 00130863
                                                                                                                                                                                                                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 001308DC
                                                                                                                                                                                                                                                                                                                                                                          • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 001308F3
                                                                                                                                                                                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 00130921
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3368777196-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 73e4535f5f2588e90cac4175166c21e852e0261ef683e09113ddda7162f872be
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9b8bf10acc6a2c636bea4ccf6c89fe996cad8873df4d5f84b07060516f36b075
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 73e4535f5f2588e90cac4175166c21e852e0261ef683e09113ddda7162f872be
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59415871900305EFDF159F54DC85AAA77B8FF08300F1480A5E905AA29BDB70DEA0DBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 001581DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0011F3AB,00000000,?,?,00000000,?,0011682C,00000004,00000000,00000000), ref: 0015824C
                                                                                                                                                                                                                                                                                                                                                                          • EnableWindow.USER32(?,00000000), ref: 00158272
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(FFFFFFFF,00000000), ref: 001582D1
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000004), ref: 001582E5
                                                                                                                                                                                                                                                                                                                                                                          • EnableWindow.USER32(?,00000001), ref: 0015830B
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0015832F
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Show$Enable$MessageSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 642888154-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6f9441cb30a9e3c2db0e3ba51e875167f790f32ca589b125dd6ea5847cdf9bc6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 978aa05f20b3c989f60731ed994b4721ac9b9a1b68464a62cccaf19999193766
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f9441cb30a9e3c2db0e3ba51e875167f790f32ca589b125dd6ea5847cdf9bc6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2A41B430601745EFDF12DF15C899BE47BF1FB0A716F184169E9289F662CB31A889CB50
                                                                                                                                                                                                                                                                                                                                                                          Function 00124C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • IsWindowVisible.USER32(?), ref: 00124C95
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00124CB2
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00124CEA
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00124D08
                                                                                                                                                                                                                                                                                                                                                                          • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00124D10
                                                                                                                                                                                                                                                                                                                                                                          • _wcsstr.LIBVCRUNTIME ref: 00124D1A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 72514467-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8da08f01231bd9d28be2bdf267e2736b6e5be79feffb6dacb4f897ca80729719
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8dbd6ce5c9765f034e19d983246c83c806fb076ffc363d4126ffb37a6d0fba78
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8da08f01231bd9d28be2bdf267e2736b6e5be79feffb6dacb4f897ca80729719
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4C210472204325BFEB155B79AC09EBB7B9CDF55750F10802AF809DA292EB61CD5086A0
                                                                                                                                                                                                                                                                                                                                                                          Function 0013581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000C3A97,?,?,000C2E7F,?,?,?,00000000), ref: 000C3AC2
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0013587B
                                                                                                                                                                                                                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 00135995
                                                                                                                                                                                                                                                                                                                                                                          • CoCreateInstance.OLE32(0015FCF8,00000000,00000001,0015FB68,?), ref: 001359AE
                                                                                                                                                                                                                                                                                                                                                                          • CoUninitialize.OLE32 ref: 001359CC
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: .lnk
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3172280962-24824748
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 96ae7aaf4f45f504de1a72acfd6c2d9399b5508efcb8d881ad92f59ac07c07a5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d046deeca5c90afedf59c3c2adf6e577c98fc09c0d523a38f3b7b8c8d7ec895b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 96ae7aaf4f45f504de1a72acfd6c2d9399b5508efcb8d881ad92f59ac07c07a5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 42D13071608601DFC714DF24C484A6EBBE6EF89B14F14885DF88A9B362DB31ED45CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 0012175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00120FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00120FCA
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00120FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00120FD6
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00120FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00120FE5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00120FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00120FEC
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00120FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00121002
                                                                                                                                                                                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?,00000000,00121335), ref: 001217AE
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000008,00000000), ref: 001217BA
                                                                                                                                                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(00000000), ref: 001217C1
                                                                                                                                                                                                                                                                                                                                                                          • CopySid.ADVAPI32(00000000,00000000,?), ref: 001217DA
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000,00121335), ref: 001217EE
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 001217F5
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3008561057-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c04f5c9b13312f08b4d3a402fbbac83fe7326c350e97db0d274652ca4fabc9cc
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0c5800aaaefb06f968b2cb46d916b8a7412ab1525de1c3831444a0ea47b257d5
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c04f5c9b13312f08b4d3a402fbbac83fe7326c350e97db0d274652ca4fabc9cc
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8611BE32500715FFDB10DFA4EC89BAF7BA9EB95356F104018F4419B211D735A990CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 001214CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 001214FF
                                                                                                                                                                                                                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 00121506
                                                                                                                                                                                                                                                                                                                                                                          • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00121515
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000004), ref: 00121520
                                                                                                                                                                                                                                                                                                                                                                          • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0012154F
                                                                                                                                                                                                                                                                                                                                                                          • DestroyEnvironmentBlock.USERENV(00000000), ref: 00121563
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1413079979-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5f6227ca41c7a357fd9a5bced16900bdc6ac5e9e21e80d740f867c981fedea63
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cb742495d1963dfb0d85c21db20141a912d1e92036ecb8521de50a4011a17f11
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f6227ca41c7a357fd9a5bced16900bdc6ac5e9e21e80d740f867c981fedea63
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA11447250024DFFDB11CFA8ED49BDA7BA9EB48705F044064FA05A60A0C3718EA0DBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000E3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,000E3379,000E2FE5), ref: 000E3390
                                                                                                                                                                                                                                                                                                                                                                          • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000E339E
                                                                                                                                                                                                                                                                                                                                                                          • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000E33B7
                                                                                                                                                                                                                                                                                                                                                                          • SetLastError.KERNEL32(00000000,?,000E3379,000E2FE5), ref: 000E3409
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3852720340-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 17e9ad32cfbe870160f762dd7885a1a512e4895422b840306089906278378f47
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0bc8454ad8873f3bae8e458ed4395308fd4058566c977cf5ac6c9872a72d0b1f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 17e9ad32cfbe870160f762dd7885a1a512e4895422b840306089906278378f47
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E016832208351BFA76627777C8D9AA2FD4EB003B9330422AF110B31F2EF210F4156A0
                                                                                                                                                                                                                                                                                                                                                                          Function 000F2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,000F5686,00103CD6,?,00000000,?,000F5B6A,?,?,?,?,?,000EE6D1,?,00188A48), ref: 000F2D78
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2DAB
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2DD3
                                                                                                                                                                                                                                                                                                                                                                          • SetLastError.KERNEL32(00000000,?,?,?,?,000EE6D1,?,00188A48,00000010,000C4F4A,?,?,00000000,00103CD6), ref: 000F2DE0
                                                                                                                                                                                                                                                                                                                                                                          • SetLastError.KERNEL32(00000000,?,?,?,?,000EE6D1,?,00188A48,00000010,000C4F4A,?,?,00000000,00103CD6), ref: 000F2DEC
                                                                                                                                                                                                                                                                                                                                                                          • _abort.LIBCMT ref: 000F2DF2
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorLast$_free$_abort
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3160817290-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 77286cd9d1b577f944186a51604a91296439f455624b0e21736702f61285148c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 150b754d0c2b868b899910d3c637a7b2aa0368bdd56779b048cdda8f8ad00414
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 77286cd9d1b577f944186a51604a91296439f455624b0e21736702f61285148c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ECF02831545B0C6BC2A22734BC0AEBF2599BFC17B1F210019FB2496DE3EF34894171A0
                                                                                                                                                                                                                                                                                                                                                                          Function 00158A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 000D9693
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9639: SelectObject.GDI32(?,00000000), ref: 000D96A2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9639: BeginPath.GDI32(?), ref: 000D96B9
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9639: SelectObject.GDI32(?,00000000), ref: 000D96E2
                                                                                                                                                                                                                                                                                                                                                                          • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00158A4E
                                                                                                                                                                                                                                                                                                                                                                          • LineTo.GDI32(?,00000003,00000000), ref: 00158A62
                                                                                                                                                                                                                                                                                                                                                                          • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00158A70
                                                                                                                                                                                                                                                                                                                                                                          • LineTo.GDI32(?,00000000,00000003), ref: 00158A80
                                                                                                                                                                                                                                                                                                                                                                          • EndPath.GDI32(?), ref: 00158A90
                                                                                                                                                                                                                                                                                                                                                                          • StrokePath.GDI32(?), ref: 00158AA0
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 43455801-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0a436127f96b2605cd492b6ea63efb7475c20d536123c269ef515d3d8348eb01
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 00fc4ea27f3dd2740896ec9ff000e6c8f6033f9ecdf4bc16844f7ba07392d7fb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0a436127f96b2605cd492b6ea63efb7475c20d536123c269ef515d3d8348eb01
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4B11DB7600024DFFDF129F94DC88EAA7F6DEB08395F048012BA199A5A1C7729D95DFA0
                                                                                                                                                                                                                                                                                                                                                                          Function 001251FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 00125218
                                                                                                                                                                                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 00125229
                                                                                                                                                                                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00125230
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00125238
                                                                                                                                                                                                                                                                                                                                                                          • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0012524F
                                                                                                                                                                                                                                                                                                                                                                          • MulDiv.KERNEL32(000009EC,00000001,?), ref: 00125261
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CapsDevice$Release
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1035833867-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0e3d60ab88a7e83b1d90d89dae25d6986ba8201ffe02f3d95925257107060d25
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 50f7f041a162a1b02f2db3579a4a5a281bcd9e85fdfde33cb3c28032558eb89b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0e3d60ab88a7e83b1d90d89dae25d6986ba8201ffe02f3d95925257107060d25
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7C018F75A00718FFEB109FA59C49A4EBFB8EB48752F044065FA04AB281D6709900CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000C1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 000C1BF4
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 000C1BFC
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 000C1C07
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 000C1C12
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 000C1C1A
                                                                                                                                                                                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 000C1C22
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Virtual
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4278518827-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8899023dfc6eaa812f40f6bc09d7b9cbb1a888a27505193debebbfaaf8cbc333
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 24a0b788c56c8f607e7fe5927ad736ab38ce076df7499988714f3e419d6a958d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8899023dfc6eaa812f40f6bc09d7b9cbb1a888a27505193debebbfaaf8cbc333
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C1016CB0902759BDE3008F5A8C85B52FFA8FF19354F00411B915C4BA41C7F5A864CBE5
                                                                                                                                                                                                                                                                                                                                                                          Function 0012EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0012EB30
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0012EB46
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 0012EB55
                                                                                                                                                                                                                                                                                                                                                                          • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0012EB64
                                                                                                                                                                                                                                                                                                                                                                          • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0012EB6E
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0012EB75
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 839392675-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 939b7ab0e6cbf075eba6949563a99f8706e189720721c2195e6bf9c0ca4d04fb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a4de9333d34ae4e3cf74faf7a81af609adaad912c65964c5bf23abb522290253
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 939b7ab0e6cbf075eba6949563a99f8706e189720721c2195e6bf9c0ca4d04fb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0BF01772240758FFE6215B629C0EEEB3A7CEBCAB12F000158F601D9591A7A05A818AF5
                                                                                                                                                                                                                                                                                                                                                                          Function 00117439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetClientRect.USER32(?), ref: 00117452
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001328,00000000,?), ref: 00117469
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowDC.USER32(?), ref: 00117475
                                                                                                                                                                                                                                                                                                                                                                          • GetPixel.GDI32(00000000,?,?), ref: 00117484
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 00117496
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(00000005), ref: 001174B0
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 272304278-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5d39f3a99d55e5a3c6ec3837a32640e4e9e2f99a41f5c0d112b079de120a3476
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2e66e3ffda473d64fcd95e5628be9af3fe26f58d6b972957a901cd93f3a7c0c2
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5d39f3a99d55e5a3c6ec3837a32640e4e9e2f99a41f5c0d112b079de120a3476
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4C014B31500315FFEB515FA4DC48BEABBB6FB04322F510164F916A7AA1CB311E91EB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00121874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0012187F
                                                                                                                                                                                                                                                                                                                                                                          • UnloadUserProfile.USERENV(?,?), ref: 0012188B
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 00121894
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 0012189C
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 001218A5
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 001218AC
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 146765662-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5d9e38e811384c4ddc0bc9332aaac19e9c45f74fcf74aa6c2fe3ab5aa437985d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: bc5fb2245f94799f2bddfb0cb5e538be1959224f7a1db5e28e55a6d2d2e6ffe0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5d9e38e811384c4ddc0bc9332aaac19e9c45f74fcf74aa6c2fe3ab5aa437985d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 90E05276104705FFDA015FA5ED0C94ABB69FB49B22B508625F22689871CB32A4A1DB90
                                                                                                                                                                                                                                                                                                                                                                          Function 0012C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0012C6EE
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012C735
                                                                                                                                                                                                                                                                                                                                                                          • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0012C79C
                                                                                                                                                                                                                                                                                                                                                                          • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0012C7CA
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ItemMenu$Info_wcslen$Default
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1227352736-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7352c9c081907c150a5b16c6eaef0ef65d56d69876feaf47f70075e35c115f3e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 10c18c4ea0c7169c71e02e6a9d18c5b5c5b16817a4b3233b83832011ba50ed38
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7352c9c081907c150a5b16c6eaef0ef65d56d69876feaf47f70075e35c115f3e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AB51F1716043219BD7149F28E884BAF77E8AF49314F040A2DFA95E3291DB70DD64CBD2
                                                                                                                                                                                                                                                                                                                                                                          Function 0014AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • ShellExecuteExW.SHELL32(0000003C), ref: 0014AEA3
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessId.KERNEL32(00000000), ref: 0014AF38
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 0014AF67
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CloseExecuteHandleProcessShell_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: <$@
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 146682121-1426351568
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 705827a10b9fbafe76037cbbd6d43a82833eab2b70e1b74b619df637786e286d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4df0c0bd07eb5199abf6723ce891d0f79aed648646556e079d7c9c484ac3a949
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 705827a10b9fbafe76037cbbd6d43a82833eab2b70e1b74b619df637786e286d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 55713671A00619DFCB14DFA4C494A9EBBF0BF08314F458499E85AAB3A2CB74ED45CB91
                                                                                                                                                                                                                                                                                                                                                                          Function 0012719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00127206
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0012723C
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0012724D
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 001272CF
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorMode$AddressCreateInstanceProc
                                                                                                                                                                                                                                                                                                                                                                          • String ID: DllGetClassObject
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 753597075-1075368562
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4c7d089a5a43afb730991e3d03fca9889e427647f05770959e7ed69fa644129e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ea06b45cceb865e3fcc751193150c9aa5a36d6fcaaf98972d9639ec9bf0ad0c6
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4c7d089a5a43afb730991e3d03fca9889e427647f05770959e7ed69fa644129e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F418D71A04314EFDB15DF94D884A9B7BA9EF44310F1580ADFD059F28AD7B0DA54CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00153D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00153E35
                                                                                                                                                                                                                                                                                                                                                                          • IsMenu.USER32(?), ref: 00153E4A
                                                                                                                                                                                                                                                                                                                                                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00153E92
                                                                                                                                                                                                                                                                                                                                                                          • DrawMenuBar.USER32 ref: 00153EA5
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Menu$Item$DrawInfoInsert
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3076010158-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 02c9707213547990d139bce0d474604eb65136777bb78c4fa628e9b78e1877b9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 355f451538e805bcef36b6b3d8ed9b624f86abd859623a73a440746569fc543d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 02c9707213547990d139bce0d474604eb65136777bb78c4fa628e9b78e1877b9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E414B75A00209EFDB10DF90D885ADAB7F5FF45395F044119ED259B250D770AE49CF60
                                                                                                                                                                                                                                                                                                                                                                          Function 00121DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00121E66
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00121E79
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000189,?,00000000), ref: 00121EA9
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C6B57: _wcslen.LIBCMT ref: 000C6B6A
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$_wcslen$ClassName
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2081771294-1403004172
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 22962cf2b0eeb58ca67e5d22116d2a52a9e7082573e7ce68731c67b2880d41eb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0dfe07e80e0a6f97bc40a34681ee27f0abeb09d656032219bad99f8529e5816e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 22962cf2b0eeb58ca67e5d22116d2a52a9e7082573e7ce68731c67b2880d41eb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 97213771A00204BEDB15EF64EC46DFFB7B9DF51350B104129F825A72E1DB344E198660
                                                                                                                                                                                                                                                                                                                                                                          Function 00152F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00152F8D
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryW.KERNEL32(?), ref: 00152F94
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00152FA9
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 00152FB1
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: SysAnimate32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3529120543-1011021900
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 122bd3a2a809ea87c891ee54c3af20e8a154fd758d893b3536095fde197c2b4d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 389de86050da0f9a3bca4032f24ae50f2ec102d12e73f85930583d50dc92c913
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 122bd3a2a809ea87c891ee54c3af20e8a154fd758d893b3536095fde197c2b4d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD218C72204205EFEB104F64EC80FBB77B9EB5A366F10461AFD60EA190D771DC959BA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000E4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,000E4D1E,000F28E9,?,000E4CBE,000F28E9,001888B8,0000000C,000E4E15,000F28E9,00000002), ref: 000E4D8D
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000E4DA0
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,?,?,?,000E4D1E,000F28E9,?,000E4CBE,000F28E9,001888B8,0000000C,000E4E15,000F28E9,00000002,00000000), ref: 000E4DC3
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 815151d89a7262a063c734d64d7b94252e95c97a0a8e65b41e7edd5e962f6314
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ee8fab756560f035d0085d820fefc488cd6f3517e21776bdb18887f96e6e5a0c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 815151d89a7262a063c734d64d7b94252e95c97a0a8e65b41e7edd5e962f6314
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F5F03C35A40308EFDB519F95DC49BEEBBE5EB44752F0400A8B805A6660CB705A90CBD1
                                                                                                                                                                                                                                                                                                                                                                          Function 000C4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,?,000C4EDD,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E9C
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 000C4EAE
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,?,?,000C4EDD,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4EC0
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 145871493-3689287502
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a0f85571bacb0a5e79c359c664a37c3faca91c8b3935156194439a4a1bf8f02f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e3f24cfd7a567f062b6165b5c94018558f3d86b975c2117652ee9631353ce635
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a0f85571bacb0a5e79c359c664a37c3faca91c8b3935156194439a4a1bf8f02f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F8E08635A01B22DFD2611F256C68F5F6694BF81F637060119FC00E6500DB60CD4185E0
                                                                                                                                                                                                                                                                                                                                                                          Function 000C4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00103CDE,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E62
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 000C4E74
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,?,?,00103CDE,?,00191418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000C4E87
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 145871493-1355242751
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e1054590682e83da9de697bd410757d6d10383af70c5c25bfc9033345f443d6c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 10aa7ec4febd8ac90c766e34783451489792b0b410ce4231648e2aa4bf08586d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e1054590682e83da9de697bd410757d6d10383af70c5c25bfc9033345f443d6c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2FD01235502B21DF96621F297C28ECF6A58BF85F523060519BD05AA555CF60CE41C5D0
                                                                                                                                                                                                                                                                                                                                                                          Function 00132947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00132C05
                                                                                                                                                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?), ref: 00132C87
                                                                                                                                                                                                                                                                                                                                                                          • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00132C9D
                                                                                                                                                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00132CAE
                                                                                                                                                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00132CC0
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: File$Delete$Copy
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3226157194-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: addf1971c581db7584bff30e04d73fd38601634871d72393fde416b3bd32683a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5db6f64145b6b56708e248a67074fe9f27521201156035cde84fd611e3f5d900
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: addf1971c581db7584bff30e04d73fd38601634871d72393fde416b3bd32683a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 38B12E71900219AFDF25EBA4CC85EDEB77DEF49350F1040A6F509E6156EB30AA448F61
                                                                                                                                                                                                                                                                                                                                                                          Function 0014A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32 ref: 0014A427
                                                                                                                                                                                                                                                                                                                                                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0014A435
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0014A468
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 0014A63D
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3488606520-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 3b9bb5681ab20564d3f0c6410ba96fd5908466f42b20655996060a3b44309d1d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: f99fbc2fe9efdee113bdb5f00376c049d9cc25e82fa84a770bcb8736d2113944
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3b9bb5681ab20564d3f0c6410ba96fd5908466f42b20655996060a3b44309d1d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6A1B0716043019FE720DF24C886F6AB7E5AF84714F55881DF59A9B3D2D7B0EC418B92
                                                                                                                                                                                                                                                                                                                                                                          Function 000FBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00163700), ref: 000FBB91
                                                                                                                                                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,0019121C,000000FF,00000000,0000003F,00000000,?,?), ref: 000FBC09
                                                                                                                                                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00191270,000000FF,?,0000003F,00000000,?), ref: 000FBC36
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FBB7F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: HeapFree.KERNEL32(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FBD4B
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1286116820-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: cbbed69aea890b8147326b1f09d49ce2c974694ca141ab2532704bfaddf8af37
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: fe57fa3eedbba77b6e72555cf8aba250189adb920a0c9ca965a1b4e3d1a18eeb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cbbed69aea890b8147326b1f09d49ce2c974694ca141ab2532704bfaddf8af37
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E951DB7190420DEFCB20EF65DC819BEB7F8EF44350B24426AE654D7991EB709E81AF90
                                                                                                                                                                                                                                                                                                                                                                          Function 0012E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0012CF22,?), ref: 0012DDFD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0012CF22,?), ref: 0012DE16
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012E199: GetFileAttributesW.KERNEL32(?,0012CF95), ref: 0012E19A
                                                                                                                                                                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0012E473
                                                                                                                                                                                                                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0012E4AC
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012E5EB
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012E603
                                                                                                                                                                                                                                                                                                                                                                          • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0012E650
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3183298772-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6cc56392560fffd2485e127e9e9f4ac5aee3d4d84149cf0f429c6ff5814c800a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 670af0b42a38d6db6e55823b4b6b851082972b6aaa35de19fcf1f3204b2912ba
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6cc56392560fffd2485e127e9e9f4ac5aee3d4d84149cf0f429c6ff5814c800a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F95153B24083959FC724EB90EC819DF73DCAF95340F40492EF689D3192EF74A6988766
                                                                                                                                                                                                                                                                                                                                                                          Function 0014B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0014B6AE,?,?), ref: 0014C9B5
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014C9F1
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA68
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014C998: _wcslen.LIBCMT ref: 0014CA9E
                                                                                                                                                                                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0014BAA5
                                                                                                                                                                                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0014BB00
                                                                                                                                                                                                                                                                                                                                                                          • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0014BB63
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?), ref: 0014BBA6
                                                                                                                                                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0014BBB3
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 826366716-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 11aa2305b651cbc5975db79f878b5bfd9dd90e78438a746a37d6b47fdb8b0a2a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d28b93e3856744dc8ddb514ac532dc78a94645030a000818810e23ca1668c88b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 11aa2305b651cbc5975db79f878b5bfd9dd90e78438a746a37d6b47fdb8b0a2a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4B616C31208241AFD714DF24C8D5E6ABBE5FF84318F54899CF4998B2A2DB31ED45CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 00128BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 00128BCD
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32 ref: 00128C3E
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32 ref: 00128C9D
                                                                                                                                                                                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00128D10
                                                                                                                                                                                                                                                                                                                                                                          • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00128D3B
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Variant$Clear$ChangeInitType
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4136290138-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 2b7a0d1c284677a059128f1ec9754c952fc3cc41060e95628d60e34986fc2dfa
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a05c221047df2524d7e3b8a689dbfde00f8671fcdfdbebaa09b2d03f9f842889
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2b7a0d1c284677a059128f1ec9754c952fc3cc41060e95628d60e34986fc2dfa
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 855159B5A01219EFDB14CF68D894EAAB7F8FF89310B158559E905DB350E730E921CFA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00138AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00138BAE
                                                                                                                                                                                                                                                                                                                                                                          • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00138BDA
                                                                                                                                                                                                                                                                                                                                                                          • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00138C32
                                                                                                                                                                                                                                                                                                                                                                          • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00138C57
                                                                                                                                                                                                                                                                                                                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00138C5F
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2832842796-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: bda716b42e6ea600937a489b0516be3427b5905792a97a56d8d49cabe4e3abab
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a1c345138d0aa051060291fe18ed7df0b694408a280f62cd068ea280c806e836
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bda716b42e6ea600937a489b0516be3427b5905792a97a56d8d49cabe4e3abab
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC511835A006159FCB05DF64C881EADBBF5FF48314F088459E849AB362DB35ED51DBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00148EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00148F40
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00148FD0
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,00000000), ref: 00148FEC
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00149032
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000), ref: 00149052
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00131043,?,7529E610), ref: 000DF6E6
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0011FA64,00000000,00000000,?,?,00131043,?,7529E610,?,0011FA64), ref: 000DF70D
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 666041331-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6c5f4a52a3fa5066373da70bdc960e6b5b4f4b9e8ee3849f0594fd399df550ed
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c40585d05bbe82e99b2ebfff2a120ce69578a4861bfc7eee649297b62c074f15
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6c5f4a52a3fa5066373da70bdc960e6b5b4f4b9e8ee3849f0594fd399df550ed
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3B513635600605DFCB15DF68C494DADBBF1FF49324B4580A9E80A9B762DB31ED89CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00156B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00156C33
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000EC,?), ref: 00156C4A
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00156C73
                                                                                                                                                                                                                                                                                                                                                                          • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0013AB79,00000000,00000000), ref: 00156C98
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00156CC7
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Long$MessageSendShow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3688381893-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9c2bae1bad8bc8f710dc28544e4ca507d0099e89715370da3a8783a06a176be9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b946714aeeb8eb5d3fc5feb23ee2e71c4033abe0697561862a49708655c759aa
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9c2bae1bad8bc8f710dc28544e4ca507d0099e89715370da3a8783a06a176be9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC41D635604204EFD724CF28CC55FA97BA5EB09361F950228FCA9AF2E1C371AD85DAC0
                                                                                                                                                                                                                                                                                                                                                                          Function 000F2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 269201875-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8a38d205a4ba14fcc708b70e68c6899bef41228852cec66a3358327d66d37c5a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 58d14d93d475f18a91d2218ef85c13c0c2854fdf3489ffec56b43c1737b91eaa
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8a38d205a4ba14fcc708b70e68c6899bef41228852cec66a3358327d66d37c5a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1741D332A003089FCB24DF78C881AADB7F5EF89314F154569E615EB792DB31AD01DB90
                                                                                                                                                                                                                                                                                                                                                                          Function 000D912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 000D9141
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(00000000,?), ref: 000D915E
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000001), ref: 000D9183
                                                                                                                                                                                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000002), ref: 000D919D
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AsyncState$ClientCursorScreen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4210589936-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d60dfc8047f65869632cac979d2193073a116ab4b933ac3433ff6811a9153a6a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 53df3745ed2c6a9a411ca68c8ca088ac6858aebfe65eaf59ca1e272333caf9b9
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d60dfc8047f65869632cac979d2193073a116ab4b933ac3433ff6811a9153a6a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D416075A0860AFBDF199F64C844BEEB774FF05320F208226E825A73D0C7346994CBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 00133874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetInputState.USER32 ref: 001338CB
                                                                                                                                                                                                                                                                                                                                                                          • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00133922
                                                                                                                                                                                                                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 0013394B
                                                                                                                                                                                                                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 00133955
                                                                                                                                                                                                                                                                                                                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00133966
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2256411358-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5e6049affda6fdfce261c52e28f3429419d34348fdf011dd35d90bb8a4253c67
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 04172ca386666c26980e0d17df44222cfbceabf9c95cc5de7649ca78abe69b96
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5e6049affda6fdfce261c52e28f3429419d34348fdf011dd35d90bb8a4253c67
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7931D570904342EEEF35CB34D849BB637A8EB05308F04056EE472C65A0E3B49AC5CB55
                                                                                                                                                                                                                                                                                                                                                                          Function 0013CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0013C21E,00000000), ref: 0013CF38
                                                                                                                                                                                                                                                                                                                                                                          • InternetReadFile.WININET(?,00000000,?,?), ref: 0013CF6F
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00000000,?,?,?,0013C21E,00000000), ref: 0013CFB4
                                                                                                                                                                                                                                                                                                                                                                          • SetEvent.KERNEL32(?,?,00000000,?,?,?,0013C21E,00000000), ref: 0013CFC8
                                                                                                                                                                                                                                                                                                                                                                          • SetEvent.KERNEL32(?,?,00000000,?,?,?,0013C21E,00000000), ref: 0013CFF2
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3191363074-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 52369a9d945b4d3e0bfd1271066a7a2022ebf47bd83944a813561284d96c931d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 09c3423ced454979a1c7cebd99538ac42e6bfac94cf85d9ac496ba870c6b7951
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 52369a9d945b4d3e0bfd1271066a7a2022ebf47bd83944a813561284d96c931d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B316B71500306EFDB24DFA5C8849ABBBFEEB14311F10842EF506E6601DB30AE41DBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00121901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00121915
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000001,00000201,00000001), ref: 001219C1
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?), ref: 001219C9
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000001,00000202,00000000), ref: 001219DA
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?), ref: 001219E2
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessagePostSleep$RectWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3382505437-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 55efd2e95ace8a38d1163678509c86f997f0a1a21089592b9756659a9b7dafb9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c4eb4a62ed7d3f2ca8df01691fa29870492f848b3abe73891cb462da83a180d6
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 55efd2e95ace8a38d1163678509c86f997f0a1a21089592b9756659a9b7dafb9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D8319171900229EFCF14CFA8DD99ADE7BB5EB54319F104225F921AB2D1C7709A94CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00155706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00155745
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001074,?,00000001), ref: 0015579D
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001557AF
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001557BA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00155816
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 763830540-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 287d5e540b0b55b35a3de3da4ef5baaa42a432434abb5470be66161fd6903639
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 69c276bc6b3ffa90c51adbb7d1870a5ccd85534d926c82de883d01fbe27c08d6
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 287d5e540b0b55b35a3de3da4ef5baaa42a432434abb5470be66161fd6903639
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB218571904618DADB209FA1CC85AED7BB9FF04726F108256ED39EE181E7708AC9CF50
                                                                                                                                                                                                                                                                                                                                                                          Function 00140930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • IsWindow.USER32(00000000), ref: 00140951
                                                                                                                                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00140968
                                                                                                                                                                                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 001409A4
                                                                                                                                                                                                                                                                                                                                                                          • GetPixel.GDI32(00000000,?,00000003), ref: 001409B0
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000003), ref: 001409E8
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$ForegroundPixelRelease
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4156661090-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 3239293efdda94dc5345fe0dd1d30e7dbc6b0ce2d740e28e6eee181006251116
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3ae7095384eaa390a5e445eaf1e722d5e75475223cbd48a82212d09b6bbb2410
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3239293efdda94dc5345fe0dd1d30e7dbc6b0ce2d740e28e6eee181006251116
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F216D35600214EFD704EF65C885AAEBBE9EF58701F04846CF84A9B762CB30AD44CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 000FCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetEnvironmentStringsW.KERNEL32 ref: 000FCDC6
                                                                                                                                                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000FCDE9
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F3820: RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852
                                                                                                                                                                                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 000FCE0F
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FCE22
                                                                                                                                                                                                                                                                                                                                                                          • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000FCE31
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 336800556-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 129ce3d3142454bae41996a5b0f83150edbe35a1f94bdf442cc4c534a3d591ae
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 88b53ea378201cdbf88c493156b1c0ab93c8abd9dec09650e4ce2ad4cb158033
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 129ce3d3142454bae41996a5b0f83150edbe35a1f94bdf442cc4c534a3d591ae
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22018872A0171DBF33611A7A6D89DBF79ADEFC6BA13150129FA05C7901DA618D01A1F0
                                                                                                                                                                                                                                                                                                                                                                          Function 000D9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 000D9693
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 000D96A2
                                                                                                                                                                                                                                                                                                                                                                          • BeginPath.GDI32(?), ref: 000D96B9
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 000D96E2
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ObjectSelect$BeginCreatePath
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3225163088-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 2af06f765c6ea15dd036ba1eaef09794f3ec9068fc894614f94e30ddfa0e1066
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 71d228909d3141b82fdb6e57ed2ced9a99ff6276c34a96134a3b468ac6123681
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2af06f765c6ea15dd036ba1eaef09794f3ec9068fc894614f94e30ddfa0e1066
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46214970802306EFDB119F65EC58BAD7BB9BB5036AF104217F821A66E0D37098D1CBA4
                                                                                                                                                                                                                                                                                                                                                                          Function 00125711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _memcmp
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2931989736-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: bc4aa5fc11381d476c3281bc8537a37f5b29bd164323ab1d10a3f333eea4e0d3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a93867109d4f359e6f402fc2f314eecba62263871b11e45c30515c2d86bfa2ce
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bc4aa5fc11381d476c3281bc8537a37f5b29bd164323ab1d10a3f333eea4e0d3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4201B971681655FFD3089621ADC2FFB735E9B613A5F804034FD14AE242F770EE2582A0
                                                                                                                                                                                                                                                                                                                                                                          Function 000F2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,000EF2DE,000F3863,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6), ref: 000F2DFD
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2E32
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2E59
                                                                                                                                                                                                                                                                                                                                                                          • SetLastError.KERNEL32(00000000,000C1129), ref: 000F2E66
                                                                                                                                                                                                                                                                                                                                                                          • SetLastError.KERNEL32(00000000,000C1129), ref: 000F2E6F
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorLast$_free
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3170660625-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 76009ad12e89e4252af71b969b958de477a7a52d20eab6f4a033c9fd09c87eb6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6e327fe2f3dcbefe30cbb0c482653443496252a69aaf12251ab7ad601b16c44a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 76009ad12e89e4252af71b969b958de477a7a52d20eab6f4a033c9fd09c87eb6
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6701F932245B0CABC65267746C45D7F2999BBD17717310025FB2193E93EB708D417160
                                                                                                                                                                                                                                                                                                                                                                          Function 0012000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?,?,0012035E), ref: 0012002B
                                                                                                                                                                                                                                                                                                                                                                          • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120046
                                                                                                                                                                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120054
                                                                                                                                                                                                                                                                                                                                                                          • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?), ref: 00120064
                                                                                                                                                                                                                                                                                                                                                                          • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0011FF41,80070057,?,?), ref: 00120070
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3897988419-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 638b3fe3b8cd6a7fdc8ced83bce8677b32c5fa4bdb983c2c7406482715991aa1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a1ecdaa1c54751f66b64a71ac297b3c2fa697e974267ba801a29feb8036a8b77
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 638b3fe3b8cd6a7fdc8ced83bce8677b32c5fa4bdb983c2c7406482715991aa1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5201A772600314FFEB114F64EC44BAA7AEDEF48792F144214F905D6221D771DD5087A4
                                                                                                                                                                                                                                                                                                                                                                          Function 0012E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?), ref: 0012E997
                                                                                                                                                                                                                                                                                                                                                                          • QueryPerformanceFrequency.KERNEL32(?), ref: 0012E9A5
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000), ref: 0012E9AD
                                                                                                                                                                                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?), ref: 0012E9B7
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32 ref: 0012E9F3
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2833360925-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5722cfd8e1770e25627ec113d6ff09b00caf4f03cb4d30986c5d789fae415ad1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7e696ec471462dfb12bf3799b62137f7ab2d2f4082337ff6a3991765756c4a7d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5722cfd8e1770e25627ec113d6ff09b00caf4f03cb4d30986c5d789fae415ad1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41011731C01A39DBCF00AFE5E899AEDBBB8BB09705F010556E502B2241CB3495A4CBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 001210F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00121114
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121120
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 0012112F
                                                                                                                                                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00120B9B,?,?,?), ref: 00121136
                                                                                                                                                                                                                                                                                                                                                                          • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0012114D
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 842720411-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 1e87e32831bbcc18d5c7d10a1cc3a9ef4ec96ec3fdd70a9ad90af60ffcb91f25
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6dc3499f66fdeb4a483e2d32bb9ed5e1c05717da8b5a265f3a481bbd5214dee2
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1e87e32831bbcc18d5c7d10a1cc3a9ef4ec96ec3fdd70a9ad90af60ffcb91f25
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 21016D79100315FFDB114F64EC49A6A3F6EEF89361B140414FA41D7350DB31DC50CAA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00120FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00120FCA
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00120FD6
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00120FE5
                                                                                                                                                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00120FEC
                                                                                                                                                                                                                                                                                                                                                                          • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00121002
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 44706859-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7a5c5489eca32673e393974af274d1c48aed29d375b5ecd38dc37a7b758cabb2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ae8e797b54ed9d018ad681d0893b3e53d6a99649b88dd89e95091f0c9049a9ad
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7a5c5489eca32673e393974af274d1c48aed29d375b5ecd38dc37a7b758cabb2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E7F04F39100315FFDB214FA5AC89F5A3BADEF89762F104414F945CA291CA70DC908AA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00121014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0012102A
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00121036
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00121045
                                                                                                                                                                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0012104C
                                                                                                                                                                                                                                                                                                                                                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00121062
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 44706859-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8da0688ff3aa13191febc7d76d0e7a451bd031ed38778d45327fc9a525967a93
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c1653278e230066f064cd2500560ca5a34502c43c411f12f79a10f8166c6cbda
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8da0688ff3aa13191febc7d76d0e7a451bd031ed38778d45327fc9a525967a93
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1DF04F39100355FFDB215FA5EC49F5A3BADEF89762F200414F945CA290CA70D8908AA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0013030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 00130324
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 00130331
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 0013033E
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 0013034B
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 00130358
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,0013017D,?,001332FC,?,00000001,00102592,?), ref: 00130365
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CloseHandle
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2962429428-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b4de72970c704654712b5ffaae75d8b8ca4363b9257d67d64cff18660d0b4a00
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 36a4b1e9267a30400de3479db76df40592e8db6ac58a41bc8f677a82a173a13d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b4de72970c704654712b5ffaae75d8b8ca4363b9257d67d64cff18660d0b4a00
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 31019872800B15DFCB32AF66D8A0812FBF9BF642153158A3ED19652931C3B1A998CE80
                                                                                                                                                                                                                                                                                                                                                                          Function 000FD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD752
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: HeapFree.KERNEL32(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD764
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD776
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD788
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000FD79A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 776569668-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 5f03b00cfb4c868c3fd05208f92faf1b8d152eefeb90203ecf35f2141a2de9a3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 29d0ad801934bce89f955e85ee25156e8d546cc6de177cf0cbbc502a1666be2c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f03b00cfb4c868c3fd05208f92faf1b8d152eefeb90203ecf35f2141a2de9a3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7FF0FF3258830EAB8661FB64F9C5C6A77DEBB447107A40806F258EBD12D774FC80A7B4
                                                                                                                                                                                                                                                                                                                                                                          Function 00125C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00125C58
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowTextW.USER32(00000000,?,00000100), ref: 00125C6F
                                                                                                                                                                                                                                                                                                                                                                          • MessageBeep.USER32(00000000), ref: 00125C87
                                                                                                                                                                                                                                                                                                                                                                          • KillTimer.USER32(?,0000040A), ref: 00125CA3
                                                                                                                                                                                                                                                                                                                                                                          • EndDialog.USER32(?,00000001), ref: 00125CBD
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3741023627-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: af7bffcce8f5a4dedd386e093c86a0018839ff9a539eeb7e050be94ff956a3f0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0b890fe14db93620f30d0b2c49164e126f61e0ddbf03dc2cfa188ebf058889ab
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: af7bffcce8f5a4dedd386e093c86a0018839ff9a539eeb7e050be94ff956a3f0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D018630500B14EFEB255F10ED8EFA677BDBB04B06F000559A583A55E1EBF0AAE48B90
                                                                                                                                                                                                                                                                                                                                                                          Function 000F22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F22BE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: HeapFree.KERNEL32(00000000,00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000), ref: 000F29DE
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F29C8: GetLastError.KERNEL32(00000000,?,000FD7D1,00000000,00000000,00000000,00000000,?,000FD7F8,00000000,00000007,00000000,?,000FDBF5,00000000,00000000), ref: 000F29F0
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F22D0
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F22E3
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F22F4
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F2305
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 776569668-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: dc920c5aa96564e4ec0faf0866ab35c775ef5bcb82463a1625611c681172c07c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5f342b14bb8839532de3aefccd9305d2b0104601d672d8c9e0fbd46469ae0059
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc920c5aa96564e4ec0faf0866ab35c775ef5bcb82463a1625611c681172c07c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AFF03A71884126AB8613BF54BC018AC3BA4BB19B60710050BF514D7FB2C7702AD1BFE4
                                                                                                                                                                                                                                                                                                                                                                          Function 000D95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • EndPath.GDI32(?), ref: 000D95D4
                                                                                                                                                                                                                                                                                                                                                                          • StrokeAndFillPath.GDI32(?,?,001171F7,00000000,?,?,?), ref: 000D95F0
                                                                                                                                                                                                                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 000D9603
                                                                                                                                                                                                                                                                                                                                                                          • DeleteObject.GDI32 ref: 000D9616
                                                                                                                                                                                                                                                                                                                                                                          • StrokePath.GDI32(?), ref: 000D9631
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2625713937-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7a82e0304ac4b490f9c3c951ec0800a4157eb697475086fa59e983aec0f3d429
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: dbeab94d337b0dc8d52bf98d906ebf92e563f548e991b312f249c0a3c6cd05f8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7a82e0304ac4b490f9c3c951ec0800a4157eb697475086fa59e983aec0f3d429
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6EF0373400670AFFDB625F69ED5CB683BA1EB003AAF048226F425599F0C73189D1DF64
                                                                                                                                                                                                                                                                                                                                                                          Function 000F0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: __freea$_free
                                                                                                                                                                                                                                                                                                                                                                          • String ID: a/p$am/pm
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3432400110-3206640213
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 043d16d4f16c46e711c3da1ee47e154d5f24f58a6ab5c6f830f73b0eabe8a73c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9ff2737b3f115868abc35045696de635fece3b78efbb9eb3296ba5fd037f80c1
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 043d16d4f16c46e711c3da1ee47e154d5f24f58a6ab5c6f830f73b0eabe8a73c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C3D1DE7190020EDADB688F68C855AFEB7F1FF05310F280119EB01ABE91D7759E80EB91
                                                                                                                                                                                                                                                                                                                                                                          Function 00147B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E0242: EnterCriticalSection.KERNEL32(0019070C,00191884,?,?,000D198B,00192518,?,?,?,000C12F9,00000000), ref: 000E024D
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E0242: LeaveCriticalSection.KERNEL32(0019070C,?,000D198B,00192518,?,?,?,000C12F9,00000000), ref: 000E028A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E00A3: __onexit.LIBCMT ref: 000E00A9
                                                                                                                                                                                                                                                                                                                                                                          • __Init_thread_footer.LIBCMT ref: 00147BFB
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E01F8: EnterCriticalSection.KERNEL32(0019070C,?,?,000D8747,00192514), ref: 000E0202
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E01F8: LeaveCriticalSection.KERNEL32(0019070C,?,000D8747,00192514), ref: 000E0235
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 5$G$Variable must be of type 'Object'.
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 535116098-3733170431
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d5948a129e0b6b82700321b7abfa27a12827f9b289bc5fb7b6ba97279f30ff32
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 50b11673c6e000f57f422b4bfd6d3b2de72804ca89b7037a0f5be6d29aeefad8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d5948a129e0b6b82700321b7abfa27a12827f9b289bc5fb7b6ba97279f30ff32
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 61917870A04209EFCB14EF94D991DBDB7B2FF49304F148059F816AB2A2DB71AE85CB51
                                                                                                                                                                                                                                                                                                                                                                          Function 00122716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,001221D0,?,?,00000034,00000800,?,00000034), ref: 0012B42D
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00122760
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,001221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0012B3F8
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0012B355
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00122194,00000034,?,?,00001004,00000000,00000000), ref: 0012B365
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00122194,00000034,?,?,00001004,00000000,00000000), ref: 0012B37B
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 001227CD
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0012281A
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                                                                                                                                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4150878124-2766056989
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b0543f6659b844c0bdff4520ecda633bfcd878c939e7a1a61d27224bea4ea4ab
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 70930119dd3e87963004a217d3f5ebc86fc4ec36f4c91b555ef1675440e5438a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b0543f6659b844c0bdff4520ecda633bfcd878c939e7a1a61d27224bea4ea4ab
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 27412D72900228BFDB10DFA4DD81ADEBBB8EF15300F004059FA55B7181DB706E55CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000F172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 000F1769
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F1834
                                                                                                                                                                                                                                                                                                                                                                          • _free.LIBCMT ref: 000F183E
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free$FileModuleName
                                                                                                                                                                                                                                                                                                                                                                          • String ID: C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2506810119-517116171
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: fd16331fffe92521b29b14be3ce279180464d5f3c51c284caa414dd160e7b248
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7f61819c330f8462a6a59cbfc0f545b0390fb2cb257e425d46d215a8891373c1
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fd16331fffe92521b29b14be3ce279180464d5f3c51c284caa414dd160e7b248
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D31B171A0430DFFCB21EB999981DEEBBFCEB84350F244166E60497611DB704A81EB90
                                                                                                                                                                                                                                                                                                                                                                          Function 0012C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0012C306
                                                                                                                                                                                                                                                                                                                                                                          • DeleteMenu.USER32(?,00000007,00000000), ref: 0012C34C
                                                                                                                                                                                                                                                                                                                                                                          • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00191990,015B5910), ref: 0012C395
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Menu$Delete$InfoItem
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 135850232-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: dc44fa1bf618d321511555fac3bb8570c6593337219b7d804a0c28d7e7b4c4f5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 523b40525d9952b4af78ab7dcca7c7262adc0419d9965458090293cb29807037
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc44fa1bf618d321511555fac3bb8570c6593337219b7d804a0c28d7e7b4c4f5
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3041BE312043519FD724DF25E884B6EBBE8BF95320F008A1DFAA5972D1D730E914CBA2
                                                                                                                                                                                                                                                                                                                                                                          Function 00154416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0015CC08,00000000,?,?,?,?), ref: 001544AA
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32 ref: 001544C7
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 001544D7
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Long
                                                                                                                                                                                                                                                                                                                                                                          • String ID: SysTreeView32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 847901565-1698111956
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 747af6f29087c012aa78ee1dbd2d111aff8b9a976bd71cbff5207acd95741866
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 008eebb42409e0576dcacfa4fa424bdf95839a0324d4a0a2903df519f44eae17
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 747af6f29087c012aa78ee1dbd2d111aff8b9a976bd71cbff5207acd95741866
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 74319A31250205AFDF208E78DC45BEA7BA9EB08329F204315FD79A62E1D770EC949B50
                                                                                                                                                                                                                                                                                                                                                                          Function 0014304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0014335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00143077,?,?), ref: 00143378
                                                                                                                                                                                                                                                                                                                                                                          • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0014307A
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0014309B
                                                                                                                                                                                                                                                                                                                                                                          • htons.WSOCK32(00000000,?,?,00000000), ref: 00143106
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 255.255.255.255
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 946324512-2422070025
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 501d7f57d64639b8abfb233bef6e7deb496c7e982dab56119ad0fea881e2e220
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: a4e3dd74fed773adbd3ca7eebdfeab234d7cae1586d240215074856e37dda9e0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 501d7f57d64639b8abfb233bef6e7deb496c7e982dab56119ad0fea881e2e220
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5B31D335200301DFDB14CF68C585EAA77E0EF54318F258199E9259B7A2DB72EE45C760
                                                                                                                                                                                                                                                                                                                                                                          Function 00153EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00153F40
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00153F54
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00153F78
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$Window
                                                                                                                                                                                                                                                                                                                                                                          • String ID: SysMonthCal32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2326795674-1439706946
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 31810c87d906c49b5d74eb1ef302a2e36bbd8866d1ad25982859382db440b486
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0a8715f2fe0a9095e3f7880640380035eb1b5915da1eb165fb220645fb99a3cb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 31810c87d906c49b5d74eb1ef302a2e36bbd8866d1ad25982859382db440b486
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B121BC32600219BFDF218F90CC46FEA3BB9EB48754F110215FE256B1D0D7B1A9A4CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00154653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00154705
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00154713
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0015471A
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$DestroyWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: msctls_updown32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4014797782-2298589950
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4c31d95b911a3ce46d5df0eeb5b4ea630a0cbd6238381749c004429b2ececc5c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: aa443d9501adfe21d493926a497dd7507c36f0f4683adc80a7ffe76e66c93316
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4c31d95b911a3ce46d5df0eeb5b4ea630a0cbd6238381749c004429b2ececc5c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0F219DB5600209EFEB11DF64DCC1DAB37ADEB5A3A9B000059FA109B391CB31EC95CB60
                                                                                                                                                                                                                                                                                                                                                                          Function 001295AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 176396367-2734436370
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: fde0f25a22f1d7601e0bf4046fb5ffc17766091b4670f13cc2134e3c5b38d4c2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ad928abcc11afc8ffc2156ec46df360a1d8a20d7717e3842be08f86c2112a0b5
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fde0f25a22f1d7601e0bf4046fb5ffc17766091b4670f13cc2134e3c5b38d4c2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E215B32204271AAD331AB2DFC02FFB73D89F51300F10402AF949AB142EB919D66C3E5
                                                                                                                                                                                                                                                                                                                                                                          Function 001537B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00153840
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00153850
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00153876
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend$MoveWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Listbox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3315199576-2633736733
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d1671245cb824bf490c8afab56ad8b7710bcdec5de20ac3349efe6b1bede9d79
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 574e02928c6f4db7d5f51248f384777508bc7868c7f975050815be77ba51897d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d1671245cb824bf490c8afab56ad8b7710bcdec5de20ac3349efe6b1bede9d79
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB21B072600218BFEB218F64CC81FAB376AEF89791F108114F9209B190C771DC568BA0
                                                                                                                                                                                                                                                                                                                                                                          Function 001349F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 00134A08
                                                                                                                                                                                                                                                                                                                                                                          • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00134A5C
                                                                                                                                                                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000000,?,?,0015CC08), ref: 00134AD0
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorMode$InformationVolume
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %lu
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2507767853-685833217
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b09b3d08d788e1d9d50b8ab80ab044b1be05803fe5b3f1472d7a3839fa313a05
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0e5db63174e46a988f02dcb8bfa8abe603817a94f7101d25dcce764a3d2a8685
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b09b3d08d788e1d9d50b8ab80ab044b1be05803fe5b3f1472d7a3839fa313a05
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4310F75A00209AFDB10DF54C985EAE7BF8EF05308F148099F909DB252D775ED45CBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 001541EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0015424F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00154264
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00154271
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID: msctls_trackbar32
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3850602802-1010561917
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: fb6870eb4be131d63185a13d7aaef574b1b18b731b0d4fee5848c548c3c34228
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5b6f855c76627bf5a90325cf00ac2cd44854ade436af67b35a9d4144a8241623
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fb6870eb4be131d63185a13d7aaef574b1b18b731b0d4fee5848c548c3c34228
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB11E331240208BFEF205F29DC46FAB3BACEF95B59F110114FA65EA090D371D8919B20
                                                                                                                                                                                                                                                                                                                                                                          Function 00155882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001558C1
                                                                                                                                                                                                                                                                                                                                                                          • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001558EE
                                                                                                                                                                                                                                                                                                                                                                          • DrawMenuBar.USER32(?), ref: 001558FD
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Menu$InfoItem$Draw
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3227129158-4108050209
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: bafc3752d3a6886909664bf795b2a00e545094788d2237404a769213ccb66174
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7d0618f89a3d9d2315dbd96690bdd18838041d9f533b5ef3c993916515b91bcb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bafc3752d3a6886909664bf795b2a00e545094788d2237404a769213ccb66174
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B016131500318EFDB119F51DC44BAEBBB5FB45366F108099E859DA261EB348A84DF71
                                                                                                                                                                                                                                                                                                                                                                          Function 0011D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0011D3BF
                                                                                                                                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32 ref: 0011D3E5
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                                                                                                                                                          • String ID: GetSystemWow64DirectoryW$X64
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3013587201-2590602151
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 67a9246ead4631ef90ec1755aafb41c8aa3cf42b837e57bbe9d318bdab56b602
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 843111912f1cd98d8e6a3c2ae258016f35b64ec2cf95ae0fd5d02685cc91741b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 67a9246ead4631ef90ec1755aafb41c8aa3cf42b837e57bbe9d318bdab56b602
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D0F0ECB5415B11DAD77C56109CC89E93314BF11711F658177E033F5095EB70C9C1C692
                                                                                                                                                                                                                                                                                                                                                                          Function 0012007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: fa20f8bdc32a29c9d9bf954c5b369f69decf51bbd6bfbc091d69c41e32cf6e24
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 140dc9c4427a502f4f04f1e133e49f68c32d01f4728729ef2b451d28bd17b72d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fa20f8bdc32a29c9d9bf954c5b369f69decf51bbd6bfbc091d69c41e32cf6e24
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4C18D75A0022AEFDB05CFA4D894EAEB7B5FF48304F118698E405EB252C731ED91CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 000F3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: __alldvrm$_strrchr
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1036877536-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 91efaf13b1dabf8f281840a8f8d3a745adcc458b549fbf52d2bee7f068c476b8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 07A13772E0038A9FDB25CF18C8917BFBBE4EF61350F18416DEA859B682C6788985D750
                                                                                                                                                                                                                                                                                                                                                                          Function 0014342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Variant$ClearInitInitializeUninitialize
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1998397398-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e933915292ed570f540c0832eb9b94bb5214102cbeafa57c54c3f3a1aa1154cc
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d4f2990d62423e16dbac07b43c11ac4cb43829ad6fffd25b553ebb2a4d181417
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e933915292ed570f540c0832eb9b94bb5214102cbeafa57c54c3f3a1aa1154cc
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9A112756047019FCB00DF28C585A6EB7E5EF88724F05885DF99A9B362DB70EE01CB92
                                                                                                                                                                                                                                                                                                                                                                          Function 00120436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0015FC08,?), ref: 001205F0
                                                                                                                                                                                                                                                                                                                                                                          • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0015FC08,?), ref: 00120608
                                                                                                                                                                                                                                                                                                                                                                          • CLSIDFromProgID.OLE32(?,?,00000000,0015CC40,000000FF,?,00000000,00000800,00000000,?,0015FC08,?), ref: 0012062D
                                                                                                                                                                                                                                                                                                                                                                          • _memcmp.LIBVCRUNTIME ref: 0012064E
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FromProg$FreeTask_memcmp
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 314563124-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: fad6b786c41c7f8546938e46be20101d73e2b1b78a77f5b13e3c6189e0ca8aa2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 74666082e43c0e102d0f7c99f6ecfe4c9a757a4207b8a6abcef4088b6c1984f7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fad6b786c41c7f8546938e46be20101d73e2b1b78a77f5b13e3c6189e0ca8aa2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9813C71A00219EFCB05DF94C988EEEB7B9FF89315F204558E506AB251DB71AE06CF60
                                                                                                                                                                                                                                                                                                                                                                          Function 0014A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 0014A6AC
                                                                                                                                                                                                                                                                                                                                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 0014A6BA
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 0014A79C
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 0014A7AB
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00103303,?), ref: 000DCE8A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1991900642-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6a07ee0d6d4d5984295bf318d3ee175fbf75193cb29cab1c9701d2887bebb9eb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e16b1ae372f47376193db9afcd8ea7ffa8e1e89b6d6fe7ad8de9fb20bd11fbfc
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6a07ee0d6d4d5984295bf318d3ee175fbf75193cb29cab1c9701d2887bebb9eb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 895108715083019FD710DF24C886EAEBBE8FF89754F40491DF59A972A2EB31D905CBA2
                                                                                                                                                                                                                                                                                                                                                                          Function 00101391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _free
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 269201875-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 2c994f5990f25dbd92465ee50ebd3d544c26aa452e2e895c7ba7aa4909eaaeaa
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4652eee0b3faf86ad37614c447c0efcde027551edf4762597d85d63f4cea990a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2c994f5990f25dbd92465ee50ebd3d544c26aa452e2e895c7ba7aa4909eaaeaa
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B8413931A00505BFDB256FB98C45AFE3AA4FF52330F144229F958D71E3EBB888419262
                                                                                                                                                                                                                                                                                                                                                                          Function 00156278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 001562E2
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00156315
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00156382
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$ClientMoveRectScreen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3880355969-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: cf7aa37cb3f36a3621df46b684cd979d749c9ad3f7c6f0e9666e4e1bdbb2282b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e32eddbc66bb03d23f336c6588e703a1f37e9a81fea50f6ac3c6e529ce3953c8
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cf7aa37cb3f36a3621df46b684cd979d749c9ad3f7c6f0e9666e4e1bdbb2282b
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2E513D74A00209EFCF10DF68D881AAE7BB5FF55365F508169F8699B2A0D730ED85CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00141AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • socket.WSOCK32(00000002,00000002,00000011), ref: 00141AFD
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 00141B0B
                                                                                                                                                                                                                                                                                                                                                                          • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00141B8A
                                                                                                                                                                                                                                                                                                                                                                          • WSAGetLastError.WSOCK32 ref: 00141B94
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorLast$socket
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1881357543-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7350b13cb3838a38fa756adafc7d80cc4e35aafcf22c63578a73d96a285850cc
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: de808eca79781f852cb17f6ae37c76e9c7391132097e6627b5667ae5bd318dd0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7350b13cb3838a38fa756adafc7d80cc4e35aafcf22c63578a73d96a285850cc
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EF417B74600300AFE720AF24C886F6A77A5EB44718F54849CF91A9F7D3D772ED828B90
                                                                                                                                                                                                                                                                                                                                                                          Function 000FB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: aa26b9a0038ebd457965aadf402db539ef03af945ade92458bcb4317f3f4152d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8ef4029f8a1e02ad19b60985b5ab059d78e893697a79cbee99464319d5e06b3a
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: aa26b9a0038ebd457965aadf402db539ef03af945ade92458bcb4317f3f4152d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B441E976900708BFD724AF38CD41BBE7BE9EB84710F10452AF651DBA82D775A9019B80
                                                                                                                                                                                                                                                                                                                                                                          Function 001356D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00135783
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00000000), ref: 001357A9
                                                                                                                                                                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 001357CE
                                                                                                                                                                                                                                                                                                                                                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 001357FA
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3321077145-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 37ca6e10bf80499cccb6ec8d1b68318515751ad0cf7393dc171c95a95453a5bf
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cb0e92969092b4d44ad96ee3edcce2164422ffc7cbc21b11be961ed8967da12c
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 37ca6e10bf80499cccb6ec8d1b68318515751ad0cf7393dc171c95a95453a5bf
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BF411739600A10DFCB11EF15C445A5EBBE2EF89720F598498E84AAB362CB70FD41DF91
                                                                                                                                                                                                                                                                                                                                                                          Function 000FD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,000E6D71,00000000,00000000,000E82D9,?,000E82D9,?,00000001,000E6D71,8BE85006,00000001,000E82D9,000E82D9), ref: 000FD910
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000FD999
                                                                                                                                                                                                                                                                                                                                                                          • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 000FD9AB
                                                                                                                                                                                                                                                                                                                                                                          • __freea.LIBCMT ref: 000FD9B4
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000F3820: RtlAllocateHeap.NTDLL(00000000,?,00191444,?,000DFDF5,?,?,000CA976,00000010,00191440,000C13FC,?,000C13C6,?,000C1129), ref: 000F3852
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2652629310-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0f0833421b00e9986f9bc391eb160dbcc1fa2b18ca91cb720d65ff05d23a97e1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 800333e01272c33c5e6cf6d94e5971878e2b06d3dc1a670259845a8cab23f6a6
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0f0833421b00e9986f9bc391eb160dbcc1fa2b18ca91cb720d65ff05d23a97e1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EE31CE72A0020AAFDB259FA5DC45EFE7BA6EB40310B05416AFD04DA151EB75CE50DBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 001552C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001024,00000000,?), ref: 00155352
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00155375
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00155382
                                                                                                                                                                                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001553A8
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: LongWindow$InvalidateMessageRectSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3340791633-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 54f38615145cc719df36c6efe18e0f95a45c8edd91cb99ee773a10ef868928b9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e78f15492936e14a999a339069147b8eb0fa61a4856b8523ca8560d0f9d27364
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 54f38615145cc719df36c6efe18e0f95a45c8edd91cb99ee773a10ef868928b9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6631B434A55A08EFEB749F14CC25BE83767BB043D2F584112FE299E2E1C7B09988D741
                                                                                                                                                                                                                                                                                                                                                                          Function 00157674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • ClientToScreen.USER32(?,?), ref: 0015769A
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00157710
                                                                                                                                                                                                                                                                                                                                                                          • PtInRect.USER32(?,?,00158B89), ref: 00157720
                                                                                                                                                                                                                                                                                                                                                                          • MessageBeep.USER32(00000000), ref: 0015778C
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1352109105-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7f46257fa5d0b57ed5d4011eb64d81bcc205696a05a9053bbf202423a061e4d2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7735b5eb68cd4792f07715b995a37310c8838926209ed6c65e6301c6f1348354
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7f46257fa5d0b57ed5d4011eb64d81bcc205696a05a9053bbf202423a061e4d2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5841AF34605255EFCB02CF58E89AEA977F4FB49306F1540A9E8249F2A1C330A989CF90
                                                                                                                                                                                                                                                                                                                                                                          Function 001516DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 001516EB
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00123A57
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: GetCurrentThreadId.KERNEL32 ref: 00123A5E
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001225B3), ref: 00123A65
                                                                                                                                                                                                                                                                                                                                                                          • GetCaretPos.USER32(?), ref: 001516FF
                                                                                                                                                                                                                                                                                                                                                                          • ClientToScreen.USER32(00000000,?), ref: 0015174C
                                                                                                                                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00151752
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2759813231-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8f743b7c2b4f9e8a555c16edeccf8038bce29b0599a80964236b2615df1a6f5f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: e39e0f7ba58f6ddae5272824f5c4e81efb0b9350a501799bd9d0c371b9ad6cf0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8f743b7c2b4f9e8a555c16edeccf8038bce29b0599a80964236b2615df1a6f5f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 53314371D00249AFD700DFA9C881DEEB7F9EF48304B50806DE425E7212D7359E45CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0012DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012DFCB
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012DFE2
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0012E00D
                                                                                                                                                                                                                                                                                                                                                                          • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0012E018
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$ExtentPoint32Text
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3763101759-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 77b70ed108f1223a20273eff2e5200c6e62d553f5a6dd90e8ad7fc9b6a902578
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: abfae5d2f51516cd0d025808dab52d14fddd927e8383037a1af5feda1999aa0e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 77b70ed108f1223a20273eff2e5200c6e62d553f5a6dd90e8ad7fc9b6a902578
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB21A175900224EFCB209FA8E981BAEB7F8EF45750F144069F805BB286D7709E41CBE5
                                                                                                                                                                                                                                                                                                                                                                          Function 00158FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00159001
                                                                                                                                                                                                                                                                                                                                                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00117711,?,?,?,?,?), ref: 00159016
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 0015905E
                                                                                                                                                                                                                                                                                                                                                                          • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00117711,?,?,?), ref: 00159094
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2864067406-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 154f570a801746f7022aeb44770450b0f631019da8c63c48abe7b944f6167111
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cf22a47d30bdf5b855917b3c525a431db38ae4eff93a76b6030cb80bf5059dec
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 154f570a801746f7022aeb44770450b0f631019da8c63c48abe7b944f6167111
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86219F35600118FFCB258F94CC58EEB7BB9EB49352F044555F9154F2A1D3319990EBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 0012D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?,0015CB68), ref: 0012D2FB
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0012D30A
                                                                                                                                                                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 0012D319
                                                                                                                                                                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0015CB68), ref: 0012D376
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2267087916-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d5ee4f367fc8018aa335a6c7d8160afedbb6ac53f1de3e25a82a43e1c01cae98
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7de5004ab907fa81fbd86cfe9ee96c98003c06da25edb7d2fe8a1c59cbf8080e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d5ee4f367fc8018aa335a6c7d8160afedbb6ac53f1de3e25a82a43e1c01cae98
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0F218DB0508311DF8310DF28E8859AE77E4FF56364F504A1DF499C72A2DB309959CB93
                                                                                                                                                                                                                                                                                                                                                                          Function 00121571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0012102A
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00121036
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00121045
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0012104C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00121014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00121062
                                                                                                                                                                                                                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 001215BE
                                                                                                                                                                                                                                                                                                                                                                          • _memcmp.LIBVCRUNTIME ref: 001215E1
                                                                                                                                                                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00121617
                                                                                                                                                                                                                                                                                                                                                                          • HeapFree.KERNEL32(00000000), ref: 0012161E
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1592001646-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 27cb08893f6e0cb4468aeb374ebddc55911b81b841cfda1198cceb776dba9141
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d126fd11002577295b32230b9097f9d08f6cdeba1b885667c998cf28184cb005
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27cb08893f6e0cb4468aeb374ebddc55911b81b841cfda1198cceb776dba9141
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B219A31E00218FFDF00DFA4D945BEEB7B8EFA4355F188499E441AB241E770AA55CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 00152782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 0015280A
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00152824
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00152832
                                                                                                                                                                                                                                                                                                                                                                          • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00152840
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Long$AttributesLayered
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2169480361-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8b5ff63868ed516390944280a0fd5d165edf5f75f32135e48680d33cd8619d31
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 31bba675f517956098f32396970f04f6ead17580ba6388db52125dfec78a8eab
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8b5ff63868ed516390944280a0fd5d165edf5f75f32135e48680d33cd8619d31
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89219032204611EFD714DB24C845FAA7B95AF56325F14815CF8268F6A2C771EC86C7D0
                                                                                                                                                                                                                                                                                                                                                                          Function 001278F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00128D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0012790A,?,000000FF,?,00128754,00000000,?,0000001C,?,?), ref: 00128D8C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00128D7D: lstrcpyW.KERNEL32(00000000,?,?,0012790A,?,000000FF,?,00128754,00000000,?,0000001C,?,?,00000000), ref: 00128DB2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00128D7D: lstrcmpiW.KERNEL32(00000000,?,0012790A,?,000000FF,?,00128754,00000000,?,0000001C,?,?), ref: 00128DE3
                                                                                                                                                                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00128754,00000000,?,0000001C,?,?,00000000), ref: 00127923
                                                                                                                                                                                                                                                                                                                                                                          • lstrcpyW.KERNEL32(00000000,?,?,00128754,00000000,?,0000001C,?,?,00000000), ref: 00127949
                                                                                                                                                                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(00000002,cdecl,?,00128754,00000000,?,0000001C,?,?,00000000), ref: 00127984
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: lstrcmpilstrcpylstrlen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: cdecl
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4031866154-3896280584
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 773372e03f8e88e7614f8e19218e3ac3dac03a9f8c33b872068cdd4792c4b206
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: d70b34c5b0f10afbbbd4f46f774ee419498087b9d379920309a3baf5129099bb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 773372e03f8e88e7614f8e19218e3ac3dac03a9f8c33b872068cdd4792c4b206
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA11063A200352AFCF156F34E844D7B77A5FF45364B00402AF906CB3A4EB319861C7A1
                                                                                                                                                                                                                                                                                                                                                                          Function 00157CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00157D0B
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00157D2A
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00157D42
                                                                                                                                                                                                                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0013B7AD,00000000), ref: 00157D6B
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$Long
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 847901565-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b07def83a732ce2c5b7493330ad9c766716cb3200f902db2e6d88344ddbb0e62
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5a7aff582a56e7f79f0d2a86fb57e34c2a14909572f3aea7f97950f7522ef3d5
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b07def83a732ce2c5b7493330ad9c766716cb3200f902db2e6d88344ddbb0e62
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB11CD31214755EFCB108FA8EC04AAA3BA5BF45362B114729FC39DB2F0E7319994CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 00155660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001060,?,00000004), ref: 001556BB
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001556CD
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001556D8
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00155816
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 455545452-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: af647d079aa09a203a97e73b22a0d42befb2ff658070f527994e19e6ed4c3751
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: faedacecb7b079ceddde45aa54d454b7b6c40150e6d5d40cfb788fd7c018558e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: af647d079aa09a203a97e73b22a0d42befb2ff658070f527994e19e6ed4c3751
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B11D671A00604EADF209F61CC95AEE777CEF10766B104026FD25EE081E770CA88CB60
                                                                                                                                                                                                                                                                                                                                                                          Function 000F1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: c940e285fab9e21298db3c579d14493e46ef47825982cde5a35e9c9e076f7c4d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 17f1165609386c9880958cafff686437077eeedb8aefa3da2af135f126e44036
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c940e285fab9e21298db3c579d14493e46ef47825982cde5a35e9c9e076f7c4d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 860162B2209A1EBEF7611A786CC1FB766ADDF413B8B341325F721A59D2DB608C4061A0
                                                                                                                                                                                                                                                                                                                                                                          Function 00121A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00121A47
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00121A59
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00121A6F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00121A8A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3850602802-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 811310a1a073faea1d2f31a124a8ff5fb0b913483f95f63b88b2af4e1bb4b92e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2a1c6cc10cb1535b7567c54c1578c6e0190e2377408007e2864dc69f3e32ea59
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 811310a1a073faea1d2f31a124a8ff5fb0b913483f95f63b88b2af4e1bb4b92e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7411273A901229FFEB10DBA4C985FADBB79EB18750F2000A1EA00B7290D7716E50DB94
                                                                                                                                                                                                                                                                                                                                                                          Function 0012E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0012E1FD
                                                                                                                                                                                                                                                                                                                                                                          • MessageBoxW.USER32(?,?,?,?), ref: 0012E230
                                                                                                                                                                                                                                                                                                                                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0012E246
                                                                                                                                                                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0012E24D
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2880819207-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 3d734a48f17922cf81408f9437a9ed0347efa1c29a1790564d02ed5847dd1a2a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 4b048ef6537beb9f3771a9c4f19a2ca6e3e785e662c5c371fd38efd24893f06f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3d734a48f17922cf81408f9437a9ed0347efa1c29a1790564d02ed5847dd1a2a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36110876904365FFC7019FA8AC05A9E7FADEB45321F10421AF925E7691D3708A808BA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000ED1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateThread.KERNEL32(00000000,?,000ECFF9,00000000,00000004,00000000), ref: 000ED218
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 000ED224
                                                                                                                                                                                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 000ED22B
                                                                                                                                                                                                                                                                                                                                                                          • ResumeThread.KERNEL32(00000000), ref: 000ED249
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 173952441-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b434d752c6325948d743f7add12bbbcfb04c669eaeaabc487adf65799818043c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3b61852498900c805f8ae008adc19dc925eaf45c920757402f8faf70ffc9c5de
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b434d752c6325948d743f7add12bbbcfb04c669eaeaabc487adf65799818043c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B8012636805248BFC7205FA7DC05BAE3B69EF81331F10025EFA24A61D1CB718841D6A0
                                                                                                                                                                                                                                                                                                                                                                          Function 00159EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 000D9BB2
                                                                                                                                                                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00159F31
                                                                                                                                                                                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00159F3B
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00159F46
                                                                                                                                                                                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00159F7A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Client$CursorLongProcRectScreenWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4127811313-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7d27850be2ca19ba5cd471b81016308e304606d0160971b6c243623f448f5e5e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3af81749f620605511d4e4df0fb64f1527545c141a53049cebc88f816d47ae4e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7d27850be2ca19ba5cd471b81016308e304606d0160971b6c243623f448f5e5e
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F911183290021AEFDB10DFA9D8859EE7BB9FB45312F400456F921EB551D730BA85CBE2
                                                                                                                                                                                                                                                                                                                                                                          Function 000C600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000C604C
                                                                                                                                                                                                                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 000C6060
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 000C606A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CreateMessageObjectSendStockWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3970641297-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 43ad090990e3f323d80fdff850e9843c3206a44b05aad776b21f13872f2660f9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 1287eeaf26e87f2f87df580236384bf742f0935efe4cb483226055f0253edbeb
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 43ad090990e3f323d80fdff850e9843c3206a44b05aad776b21f13872f2660f9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA115E72501609FFEF224F949C54FEF7BA9EF1C355F150115FA1466150D732ACA09B90
                                                                                                                                                                                                                                                                                                                                                                          Function 000E3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • ___BuildCatchObject.LIBVCRUNTIME ref: 000E3B56
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 000E3AD2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000E3AA3: ___AdjustPointer.LIBCMT ref: 000E3AED
                                                                                                                                                                                                                                                                                                                                                                          • _UnwindNestedFrames.LIBCMT ref: 000E3B6B
                                                                                                                                                                                                                                                                                                                                                                          • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 000E3B7C
                                                                                                                                                                                                                                                                                                                                                                          • CallCatchBlock.LIBVCRUNTIME ref: 000E3BA4
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 737400349-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c29a8c94b6cfaf17b75cc823f3b5dc4f8d5095e70e9e3b454a061cd1d8282620
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D7010072100189BFDF125E96CC46DEB7F6DEF98754F044054FE4866122C736D961DBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000F3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,000C13C6,00000000,00000000,?,000F301A,000C13C6,00000000,00000000,00000000,?,000F328B,00000006,FlsSetValue), ref: 000F30A5
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,000F301A,000C13C6,00000000,00000000,00000000,?,000F328B,00000006,FlsSetValue,00162290,FlsSetValue,00000000,00000364,?,000F2E46), ref: 000F30B1
                                                                                                                                                                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,000F301A,000C13C6,00000000,00000000,00000000,?,000F328B,00000006,FlsSetValue,00162290,FlsSetValue,00000000), ref: 000F30BF
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3177248105-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: ff07ab37262f860fc2557e2879dcb3638503e50973fbb78ceb9241d9035d9ae2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 53ac30f2727a46e474d74fc2f41a2414431a5e6f4fad5538246ab4a681c15bc7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ff07ab37262f860fc2557e2879dcb3638503e50973fbb78ceb9241d9035d9ae2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0801D43230132AEFCB714AB99C54A7B7BD8AF05BB1B100621FA05E7A40CF21D981D6E0
                                                                                                                                                                                                                                                                                                                                                                          Function 00127464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0012747F
                                                                                                                                                                                                                                                                                                                                                                          • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00127497
                                                                                                                                                                                                                                                                                                                                                                          • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 001274AC
                                                                                                                                                                                                                                                                                                                                                                          • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 001274CA
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Type$Register$FileLoadModuleNameUser
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1352324309-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e0d782357d96183525a9970bf71ad673c62f5da785eb7c7dd8b19098ab955b4d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9d8086fe413ae227ab718cfb27d500ed43ed01ce1fa985791dede7bef7940d57
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e0d782357d96183525a9970bf71ad673c62f5da785eb7c7dd8b19098ab955b4d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1011C0B1209360EFE720AF14EC08FA37FFCEB00B00F108569A616DA591D7B0E954DBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 00157E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00157E33
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00157E4B
                                                                                                                                                                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00157E6F
                                                                                                                                                                                                                                                                                                                                                                          • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00157E8A
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 357397906-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 47c7042000d0ff6a0e89fa9e5e34e3cefcc10b5a25749bbaf7112c66411c214f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 20b76d947c6cba400b91e069236fd0eb6c71874a52d5f973648dc3b81018dc83
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 47c7042000d0ff6a0e89fa9e5e34e3cefcc10b5a25749bbaf7112c66411c214f
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 151163B9D0024AEFDB41CF98C8859EEBBF5FB08311F104056E911E6610D734AA94CF90
                                                                                                                                                                                                                                                                                                                                                                          Function 00158863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 000D9693
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9639: SelectObject.GDI32(?,00000000), ref: 000D96A2
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9639: BeginPath.GDI32(?), ref: 000D96B9
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000D9639: SelectObject.GDI32(?,00000000), ref: 000D96E2
                                                                                                                                                                                                                                                                                                                                                                          • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00158887
                                                                                                                                                                                                                                                                                                                                                                          • LineTo.GDI32(?,?,?), ref: 00158894
                                                                                                                                                                                                                                                                                                                                                                          • EndPath.GDI32(?), ref: 001588A4
                                                                                                                                                                                                                                                                                                                                                                          • StrokePath.GDI32(?), ref: 001588B2
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1539411459-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: b162f5da58bd7644744c4d41e9fe985549d364f8696e15ff2416bd6e9d59aca3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 6545be7ec4a0f443d010cb5797108fecc51821cead222d374c7e470d1698f754
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b162f5da58bd7644744c4d41e9fe985549d364f8696e15ff2416bd6e9d59aca3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7DF05E3A041359FEDB126F94AC09FCE3F59AF06312F048001FA21694E2C7755591CFE5
                                                                                                                                                                                                                                                                                                                                                                          Function 000D98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(00000008), ref: 000D98CC
                                                                                                                                                                                                                                                                                                                                                                          • SetTextColor.GDI32(?,?), ref: 000D98D6
                                                                                                                                                                                                                                                                                                                                                                          • SetBkMode.GDI32(?,00000001), ref: 000D98E9
                                                                                                                                                                                                                                                                                                                                                                          • GetStockObject.GDI32(00000005), ref: 000D98F1
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Color$ModeObjectStockText
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 4037423528-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 39645783c03668560f5a75dd4a5b5b7dfed226c259317220db9cef907625adf1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: baa82235b9ca9b3b9af8662e25601c4e15d631cbe32a8aa3b1eb3dad159c1b06
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 39645783c03668560f5a75dd4a5b5b7dfed226c259317220db9cef907625adf1
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6CE06D31244780EEDB215F78AC09BE83F61AB52336F04822AF6FA585E1C77146809B21
                                                                                                                                                                                                                                                                                                                                                                          Function 0012162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentThread.KERNEL32 ref: 00121634
                                                                                                                                                                                                                                                                                                                                                                          • OpenThreadToken.ADVAPI32(00000000,?,?,?,001211D9), ref: 0012163B
                                                                                                                                                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,001211D9), ref: 00121648
                                                                                                                                                                                                                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000,?,?,?,001211D9), ref: 0012164F
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CurrentOpenProcessThreadToken
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3974789173-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: fe09611abc96e9289b93defb5327a4392ac0b843650aa8afca744ecf548353d7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 17a9d7aa1a0c289c449be4845a2e8ace485ab1f83db82fc57ea32d14d129dadf
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe09611abc96e9289b93defb5327a4392ac0b843650aa8afca744ecf548353d7
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EFE04F75602321EFD7601FA0AD0DB4B3B68AF54B92F144808F245CD080D7644480C790
                                                                                                                                                                                                                                                                                                                                                                          Function 0011D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 0011D858
                                                                                                                                                                                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 0011D862
                                                                                                                                                                                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 0011D882
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseDC.USER32(?), ref: 0011D8A3
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2889604237-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 39e853c2837c7551c4b2944be67eb4dec6ca6df04b817a8b29fc40e3a0af8d8d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 9a3924759927e36a0dca458ba588ee91214ebe4874df88ef21ea076839b43e28
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 39e853c2837c7551c4b2944be67eb4dec6ca6df04b817a8b29fc40e3a0af8d8d
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 62E01AB4800304DFCF419FA0D808A6DBBB1FB08312F108019F80AEB750C7384A82EF90
                                                                                                                                                                                                                                                                                                                                                                          Function 0011D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 0011D86C
                                                                                                                                                                                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 0011D876
                                                                                                                                                                                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 0011D882
                                                                                                                                                                                                                                                                                                                                                                          • ReleaseDC.USER32(?), ref: 0011D8A3
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2889604237-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 3a953013b4ff34061b98cfb0fe1c8679e0148057d477d9d6b51dfc50a572b53c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 08a75bbb2edbfb1cc04651fac4bcf8c057427ab7c7a0fbd6f2482ec3e94e6f0e
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3a953013b4ff34061b98cfb0fe1c8679e0148057d477d9d6b51dfc50a572b53c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BBE09A75800304DFCF519FA0D808A6DBBB5FB48712B148459F94AEB750C7385A42EF90
                                                                                                                                                                                                                                                                                                                                                                          Function 00134D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C7620: _wcslen.LIBCMT ref: 000C7625
                                                                                                                                                                                                                                                                                                                                                                          • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00134ED4
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Connection_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: *$LPT
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1725874428-3443410124
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 42950f266f3eee55dfff868814be9b39e955c3ecaf5842ee7b7d7d4f57338ef2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 24ebeaa50edb660d248db61a0ccb75f3532bc65f69eb284c82933b61b7ac9c2f
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 42950f266f3eee55dfff868814be9b39e955c3ecaf5842ee7b7d7d4f57338ef2
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CD916C75A002049FCB14DF58C484EAEBBF5BF49304F198099E84A9F3A2C775EE85CB90
                                                                                                                                                                                                                                                                                                                                                                          Function 000EE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • __startOneArgErrorHandling.LIBCMT ref: 000EE30D
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ErrorHandling__start
                                                                                                                                                                                                                                                                                                                                                                          • String ID: pow
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3213639722-2276729525
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 4adeffd14eb6958e17bbefbecd319c10e827a64c21c268e094347c8d824e7be0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c54ebbc3772fa74029bb4fb1705591589a0170d3315e1822c3eb4bf75e924392
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4adeffd14eb6958e17bbefbecd319c10e827a64c21c268e094347c8d824e7be0
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0651C061A0C18E9ACB257B25CD053BD3BE4EB40740F3049A9E1D953AE9EB308CC1AA43
                                                                                                                                                                                                                                                                                                                                                                          Function 000DE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                                                                                                                                          • String ID: #
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 0-1885708031
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 8187b00142ad664cfc25e8b2d44445ed6cfc520d7e5d66ade6b121dfa12f4fbb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5ef1341e69ab29ea2f6c44a2419b71fb2108e780664abfd71c634dfaa6df2d66
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8187b00142ad664cfc25e8b2d44445ed6cfc520d7e5d66ade6b121dfa12f4fbb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D351E1359043869EEB19EFA8C481AFE7BE4EF55310F64406AEC519B2D1D7309D82CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 000DF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000000), ref: 000DF2A2
                                                                                                                                                                                                                                                                                                                                                                          • GlobalMemoryStatusEx.KERNEL32(?), ref: 000DF2BB
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: GlobalMemorySleepStatus
                                                                                                                                                                                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2783356886-2766056989
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 808a3428b67e5f424018dd9b21b56acb24ea369a41d4380c15a7adf652f861f4
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 8ff3cce9c03feabd3c2b0badf5a327817842ebd4fe15aff87daa0fc1813827ce
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 808a3428b67e5f424018dd9b21b56acb24ea369a41d4380c15a7adf652f861f4
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 75513771408744ABE320AF14DC86BAFBBF8FB84300F81885DF1D941196EB718569CB67
                                                                                                                                                                                                                                                                                                                                                                          Function 00145745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 001457E0
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 001457EC
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: BuffCharUpper_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: CALLARGARRAY
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 157775604-1150593374
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d4b9b23caec54f560e372aefdb291f3dda7adadfc2ca901e08fdcbe419102b0c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b651d68b735c9721f051c698207b020c3398757f9d6c050ae90a3679b60d86d6
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d4b9b23caec54f560e372aefdb291f3dda7adadfc2ca901e08fdcbe419102b0c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F419471E0020ADFCB14DFA9C8859FEBBB6FF59314F104069E515A72A2DB309D81CBA0
                                                                                                                                                                                                                                                                                                                                                                          Function 0013D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0013D130
                                                                                                                                                                                                                                                                                                                                                                          • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0013D13A
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CrackInternet_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: |
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 596671847-2343686810
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 84cdd07f045366bd764225303bdfef2828610c7a2ff19fb1908aaf9e95f1117c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2b4866ce4bfa2f9f6c2f199037c7bfe1a6eb1ff9f4f5245806c27b87c86f2203
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 84cdd07f045366bd764225303bdfef2828610c7a2ff19fb1908aaf9e95f1117c
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 45313D71D00209ABCF15EFA5DC85EEE7FB9FF04300F000059F815A6162DB32AA56CB60
                                                                                                                                                                                                                                                                                                                                                                          Function 0015356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?), ref: 00153621
                                                                                                                                                                                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0015365C
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$DestroyMove
                                                                                                                                                                                                                                                                                                                                                                          • String ID: static
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2139405536-2160076837
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 61eb2e8f40b461d59de9f0ce001fcbd2a9dc15ba4997a9938c80d2b60b543017
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: c6f39ef7acc13139873eebce04692700a3a61c6ceb52cc5bc3c067ccae055ba4
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 61eb2e8f40b461d59de9f0ce001fcbd2a9dc15ba4997a9938c80d2b60b543017
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EF317A71110604AEDB109F28D880EFB73A9FF88761F10961DF8B59B290DB31A9869760
                                                                                                                                                                                                                                                                                                                                                                          Function 00154537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0015461F
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00154634
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID: '
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3850602802-1997036262
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7fcfe72eb8cce06ef911cc510c994c06f78d5721caecdbc8de31160c7b98bb0a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 2e43ca9b1203facc0503bcc1d06375fa905289b2da9dc896bb1377f2a36fa5f0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7fcfe72eb8cce06ef911cc510c994c06f78d5721caecdbc8de31160c7b98bb0a
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D311674A0130AEFDB14CFA9C990BDA7BB5FB09305F10406AED14AB341E770A985CF90
                                                                                                                                                                                                                                                                                                                                                                          Function 001531EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0015327C
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00153287
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Combobox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3850602802-2096851135
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 9a247d441a60a5547de56ed437399b734c5015ca05fe7a2111df6b186ab3fda9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 45f4be2c4ef013517de6c0e189b89fecc169478a8b5c004bcb99ea0d336640dd
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9a247d441a60a5547de56ed437399b734c5015ca05fe7a2111df6b186ab3fda9
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7A11B271300608BFEF259F54DC80EFB376AEB943A5F104129F938AB290D7319D959760
                                                                                                                                                                                                                                                                                                                                                                          Function 00153710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000C604C
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C600E: GetStockObject.GDI32(00000011), ref: 000C6060
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 000C606A
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 0015377A
                                                                                                                                                                                                                                                                                                                                                                          • GetSysColor.USER32(00000012), ref: 00153794
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                                                                                                                                                                                                                                                                                                                          • String ID: static
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1983116058-2160076837
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 521ad57226d8a94aad1ecf84798a4b8b519991dd7ebefc47e2353176ba285585
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: bb44183cfedf7894bee1570878b5663cfd9ad8706f2a466a09a1775c61e473ab
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 521ad57226d8a94aad1ecf84798a4b8b519991dd7ebefc47e2353176ba285585
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B11159B2A1020AEFDB00DFA8CC45EEA7BB8FB08345F004514FD65E7250E735E8559B50
                                                                                                                                                                                                                                                                                                                                                                          Function 0013CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0013CD7D
                                                                                                                                                                                                                                                                                                                                                                          • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0013CDA6
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Internet$OpenOption
                                                                                                                                                                                                                                                                                                                                                                          • String ID: <local>
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 942729171-4266983199
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e6b5e2c621bd1fd984527b197a919a8a5bd24e59ea644c76b3f57ccdf2ef7cd8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: ee290d228ee05edcdbb6aa1e288183b14e8bf88a2a9ae16061f54ade5f1a08a4
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6b5e2c621bd1fd984527b197a919a8a5bd24e59ea644c76b3f57ccdf2ef7cd8
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7D11C275205631BAD7384FA68C49EE7BEACEF127A4F00422AB109A7080D7709940D7F0
                                                                                                                                                                                                                                                                                                                                                                          Function 00153429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetWindowTextLengthW.USER32(00000000), ref: 001534AB
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 001534BA
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: LengthMessageSendTextWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: edit
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2978978980-2167791130
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 30f2651b59b558c6f953a82a7177b2363e70cd088670b06efc3bbe9e526064d3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 5beccc9d688042092cdec4c695868b6844016ac3140560ec16448efe1616add5
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 30f2651b59b558c6f953a82a7177b2363e70cd088670b06efc3bbe9e526064d3
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D7116D71100208EFEB124E64DC44AEB376AEB153B5F504724FD719B1D0C771DD999750
                                                                                                                                                                                                                                                                                                                                                                          Function 00126C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,?,?), ref: 00126CB6
                                                                                                                                                                                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00126CC2
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen$BuffCharUpper
                                                                                                                                                                                                                                                                                                                                                                          • String ID: STOP
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1256254125-2411985666
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 163895b2398689ef0ad1d06249aeb851499942605ad63591df60b29def3b14fd
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 98af179847d0cc5088e532365c7a6b6a0e183187fad9ba0b5cab2e343669eb3d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 163895b2398689ef0ad1d06249aeb851499942605ad63591df60b29def3b14fd
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA01D232A0053A8BCB20AFFDEC819BF77B5EB617547510529E8A2A71D1EB31D960C690
                                                                                                                                                                                                                                                                                                                                                                          Function 00121CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00121D4C
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClassMessageNameSend_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 624084870-1403004172
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: ba0f74c944c152b7c4e8ac2413b45e3f5a899363919bf326e6030f56304ca1cb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: aa5358293a4df2c7745149b34660b30f2803a207fc7e4139105acb24b16f1885
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ba0f74c944c152b7c4e8ac2413b45e3f5a899363919bf326e6030f56304ca1cb
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8C01D875601228FBCB08EFE4EC59DFE7769EB66350B44091AF832573C2EB3059288760
                                                                                                                                                                                                                                                                                                                                                                          Function 00121BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000180,00000000,?), ref: 00121C46
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClassMessageNameSend_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 624084870-1403004172
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7d12105283d3ef7ada983e907850633ab0d256fec9ff24f05d6ce34548604f56
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3865505470f60baca1d3fd0afd6397d4ee4423f644069c3e7eff138c64121e2d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7d12105283d3ef7ada983e907850633ab0d256fec9ff24f05d6ce34548604f56
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F0167756811187BCB18FB90E956EFF77A99B25340F140019A416772C2EB249F3C87B5
                                                                                                                                                                                                                                                                                                                                                                          Function 00121C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 00121CC8
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClassMessageNameSend_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 624084870-1403004172
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: e08e11b215195d62e760495ac1e1a301e810f25ea35dc5b11eb81643b2220e97
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 7f4740ebbab7bd4f1c9f65ac77f444f3086315226b7e81e964e64167b707a798
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e08e11b215195d62e760495ac1e1a301e810f25ea35dc5b11eb81643b2220e97
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA01D67568022877CB04FBA0DA56EFE77A99B31340F540029B81273282EB209F38C7B1
                                                                                                                                                                                                                                                                                                                                                                          Function 00121D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000C9CB3: _wcslen.LIBCMT ref: 000C9CBD
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 00123CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00123CCA
                                                                                                                                                                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00121DD3
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ClassMessageNameSend_wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 624084870-1403004172
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 6e87fb6a26dfb9950ba024ec428052cdcbf942f9d79cc4af0d3393a0bcbfe1fa
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3a26d6819d5d38b8a0739aa145ffdbb171f5be3535e7b42b8a82c896d23fdeb9
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e87fb6a26dfb9950ba024ec428052cdcbf942f9d79cc4af0d3393a0bcbfe1fa
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 58F0A971A41228B7D714FBE4DC5AFFE7768AB21350F440919B432672C2DB605A288660
                                                                                                                                                                                                                                                                                                                                                                          Function 0014747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: _wcslen
                                                                                                                                                                                                                                                                                                                                                                          • String ID: 3, 3, 16, 1
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 176396367-3042988571
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: d6b4e08805b5855b4ef86875176dfffff6bf421ff332bf280ae3fea6705678c4
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 72aba16aeedd1d01038284d9b7c35ba7109720ec8f98a045a7d31c865c76579d
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6b4e08805b5855b4ef86875176dfffff6bf421ff332bf280ae3fea6705678c4
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D8E02B02204260149231227AACC19BF5789DFC9750718182BF981E22F7EB94CD9193F1
                                                                                                                                                                                                                                                                                                                                                                          Function 00120B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00120B23
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Message
                                                                                                                                                                                                                                                                                                                                                                          • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 2030045667-4017498283
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 11c5d5467534619220029b1d4659095f32fa646df5197d803282b5f62f516b27
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: b497d935ceefffc428ef07f9e164a95eecf8f1c96e060d0721c1ec1b944a6195
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 11c5d5467534619220029b1d4659095f32fa646df5197d803282b5f62f516b27
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 65E0D8312443186ED2203B957C03FC97B85CF09F55F10446BFB58695C38BE2259046E9
                                                                                                                                                                                                                                                                                                                                                                          Function 000E0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 000DF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,000E0D71,?,?,?,000C100A), ref: 000DF7CE
                                                                                                                                                                                                                                                                                                                                                                          • IsDebuggerPresent.KERNEL32(?,?,?,000C100A), ref: 000E0D75
                                                                                                                                                                                                                                                                                                                                                                          • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,000C100A), ref: 000E0D84
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000E0D7F
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                                                                                                                                                                                                                                                                                                                                          • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 55579361-631824599
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 156779dc952e715e7b1003198834865cce243b7c3e435bab9b8b8eee3315e589
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 08ab6df9a05a67394b15aa1910d59a637a69fed563120ebcd7b97bef85a15c3b
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 156779dc952e715e7b1003198834865cce243b7c3e435bab9b8b8eee3315e589
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5EE06D74204341CFD3609FB9D8087967BE0EB00745F01892DE892DAA52DBF5E4C8CBA1
                                                                                                                                                                                                                                                                                                                                                                          Function 00133017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0013302F
                                                                                                                                                                                                                                                                                                                                                                          • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00133044
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: Temp$FileNamePath
                                                                                                                                                                                                                                                                                                                                                                          • String ID: aut
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 3285503233-3010740371
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: bb0a4b263bd1f94c1ab6597c5797734549a94ebdea0d5f6888f685b8c736f158
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: cc353d65736244ba903f87a252715e13502367cb71728f32843b77112e07f335
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bb0a4b263bd1f94c1ab6597c5797734549a94ebdea0d5f6888f685b8c736f158
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13D05E72500328ABDA20ABA4AC4EFCB7A7CDB04751F0002A1B655E6491EAB09A84CBD0
                                                                                                                                                                                                                                                                                                                                                                          Function 0011D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: LocalTime
                                                                                                                                                                                                                                                                                                                                                                          • String ID: %.3d$X64
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 481472006-1077770165
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 0d8d623c6b9dd0b18be798a3fc7de17b52d25feff83a3d294fed470b0952ee59
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: eb8bce1e9d741ea56f71f1d972f71fec7e4d409eb0fa8694b2249e15763d7e85
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0d8d623c6b9dd0b18be798a3fc7de17b52d25feff83a3d294fed470b0952ee59
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8AD01261808219E9CB5C96D0EC459F9B37CFB19341F618473F81791040E734D5886B62
                                                                                                                                                                                                                                                                                                                                                                          Function 00152322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0015232C
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0015233F
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012E97B: Sleep.KERNEL32 ref: 0012E9F3
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FindMessagePostSleepWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 529655941-2988720461
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 1935afc4de01c3fdccfe32bc1e980a891f704fc0e011dea36defebf1d46fa746
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 424b2878ce6d68d5f28f374a3464f64698d356b7b3d6766036641e7a4be95276
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1935afc4de01c3fdccfe32bc1e980a891f704fc0e011dea36defebf1d46fa746
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 07D0C976394310BAE668BB70AC1FFC67A549B10B15F0049167645AA1D0DAA0A8818A94
                                                                                                                                                                                                                                                                                                                                                                          Function 00152356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0015236C
                                                                                                                                                                                                                                                                                                                                                                          • PostMessageW.USER32(00000000), ref: 00152373
                                                                                                                                                                                                                                                                                                                                                                            • Part of subcall function 0012E97B: Sleep.KERNEL32 ref: 0012E9F3
                                                                                                                                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: FindMessagePostSleepWindow
                                                                                                                                                                                                                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 529655941-2988720461
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: a9f7162eb8017c5aecdb6bd7b56444f46da331ef866de92bcd4859ca1594ba94
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 3665c2c9e7e03b31a58c0e280893813c81cebe220cc8f8a6cc2793fe9b8246c7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9f7162eb8017c5aecdb6bd7b56444f46da331ef866de92bcd4859ca1594ba94
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 88D0C9723D1310BEE668BB70AC1FFC676549B14B15F4049167645AA1D0DAA0A8818A94
                                                                                                                                                                                                                                                                                                                                                                          Function 000FBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 000FBE93
                                                                                                                                                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 000FBEA1
                                                                                                                                                                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 000FBEFC
                                                                                                                                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                                          • Source File: 00000000.00000002.3300265290.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300125138.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.000000000015C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3300851619.0000000000182000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301311533.000000000018C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          • Associated: 00000000.00000002.3301486490.0000000000194000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_c0000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                                                                                                                                          • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                                                                                                                                          • API String ID: 1717984340-0
                                                                                                                                                                                                                                                                                                                                                                          • Opcode ID: 7ea89eafef56f0bd70ae3cc4e3c041059ac361ccd8ce3e2a506c416288021723
                                                                                                                                                                                                                                                                                                                                                                          • Instruction ID: 0404d657a9bc5467b117c5579d690e834103ce724a262660a2ed0071fd0dcaa7
                                                                                                                                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7ea89eafef56f0bd70ae3cc4e3c041059ac361ccd8ce3e2a506c416288021723
                                                                                                                                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4641C13460420AEFCB718F65CC44ABA7BE5EF41320F294169FA599B5A2DB318D04EF60